North Korean Hackers Used $90 Meme Coins to Launder Stolen Binance Crypto, Elliptic Says

• North Korean launderers created six meme coins on NEAR for about $90 each.
• Roughly 117,000 NEAR, worth about $430,000, moved through the tokens from Nov. 5 to Nov. 7.
• Laundering wallets placed every sell order in all six tokens.
• About 11.8 million NEAR, worth $43.7 million, from the Binance hack has not moved yet.
• Elliptic told compliance teams not to treat liquidity pool funds as clean by default.

North Korean launderers spent about $90 each to create six meme coins on the NEAR blockchain, according to blockchain analytics firm Elliptic. The tokens were used to move stolen funds from the Oct. 29 Binance hack.

Elliptic said about 117,000 NEAR, worth roughly $430,000, passed through the tokens between Nov. 5 and Nov. 7. The firm published its findings in a report on Monday.

The six tokens were named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each cost about 25 NEAR to launch using a public token creation tool.

The tokens carried cartoon meme coin artwork. One showed a monkey with a pink bow, another a duck in front of an American flag, and a third showed Elon Musk under an “Elon 2028 President” banner. Elliptic said there is no suggestion Musk has any link to the tokens.

How the Pools Hid the Trail

The launderers paired each new token with NEAR in its own liquidity pool. A liquidity pool is a pot of two assets on a decentralized exchange that anyone can trade against.

One group of wallets used stolen NEAR to buy the new token from the pool. A second group of wallets then sold the token back and pulled NEAR out.

Because the pool sat in the middle, no transfer linked the two groups directly. “They exist only to put a pool between the stolen funds and the next wallet,” Elliptic wrote on X.

North Korea’s launderers are creating their own meme coins to move funds stolen from Binance.

Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went…

— Elliptic (@elliptic) November 9, 2026

Elliptic said the trading data showed the tokens had no other purpose. The laundering wallets placed every sell order in all six tokens and every buy order in five of them.

The only exception was a small number of FUK purchases on launch day. Those buys made up a sliver of the token’s trading.

The tokens were also linked in a chain. In five cases, the wallet that funded a new token’s creator had been selling the previous token just 2 to 13 minutes before the next launch.

A Method First Seen With Bybit

Elliptic said it first spotted the technique after Bybit lost $1.5 billion in 2025. In that case, launderers used a worthless Tron token to move at least $24 million.

In the Binance case, a similar Tron token appeared on Nov. 2. A day later, stolen SOL moved through existing Solana tokens with thin trading.

The NEAR route covers less than 0.01% of the roughly $6.3 billion taken from Binance. The FBI has attributed the theft to North Korea’s TraderTraitor hacking group.

Elliptic said about 3,000 bitcoin, worth around $225 million, have landed in new bitcoin addresses after being converted from other stolen assets. About 11.8 million NEAR, worth $43.7 million, has not moved yet.

“The technique slows investigators down rather than hiding the funds,” Elliptic co-founder Tom Robinson wrote. He added that North Korea’s launderers “layer many cheap techniques, each adding a little more delay.”

Days before the tokens appeared, Jonty, founder of Pangolin Intelligence, said on Unchained that these networks move funds between wallets “to essentially evade the eyes of transaction monitoring software.”

Elliptic told compliance teams not to treat funds from a liquidity pool as clean by default. Warning signs include tokens only days old, pools with few traders and wallets that only buy or only sell.

None of the six NEAR tokens has traded since Nov. 8. That afternoon, four of the token creators pulled the funds still sitting in their pools.