Hackers responsible for the record-breaking US$6.3 billion theft from Binance have turned to memecoins to launder a portion of the stolen cryptocurrency. According to blockchain analytics firm Elliptic, at least six new tokens were created on the NEAR blockchain network shortly after the heist, facilitating the laundering of approximately US$430,000 of the stolen funds.
The scheme involved creating tokens with cartoonish logos, such as a monkey wearing a pink bow and an image of Elon Musk with the banner “Elon 2028 President.” These tokens were traded heavily for a few hours before being abandoned, making it difficult to trace the illicit funds. The hackers used stolen NEAR tokens to buy these memecoins on decentralized exchanges, allowing them to move the stolen assets into unconnected wallets.
About US$44 million in stolen NEAR remains untouched, while the hackers have employed various tactics to obscure the origins of the funds. The automated nature of the transactions involved over 20,000 wallets and at least 65,000 transactions within a week of the hack, according to Elliptic. The attackers have also utilized decentralized privacy-focused networks like THORChain, Privacy Cash, and Wasabi Wallet to execute trades.
US authorities have attributed the attack to the TraderTraitor group, linked to North Korea. Binance co-CEO Richard Teng reported that around US$2.85 billion of the stolen crypto was either frozen or intercepted, much of it in stablecoins where issuers like Tether and Circle Internet Group can prevent tokens from being swapped for real cash.