North Korean hackers have been using memecoins to launder cryptocurrency stolen from the massive $6.4 billion Binance hack. According to blockchain analytics firm Elliptic, the hackers routed approximately $430,000 through six newly created tokens on the NEAR blockchain between November 5 and 7. The tokens were quickly abandoned after launch and saw almost no external trading.
The hackers employed a sophisticated method to obscure the transfers. They used liquidity pools on decentralized exchanges to move stolen funds between wallets without direct transfers, though the transactions remained traceable onchain. Elliptic found that five of the six token creators were funded with proceeds from earlier token sales just minutes before the next launch, linking the tokens in a chain of transactions.
Elliptic co-founder Tom Robinson noted that North Korean launderers rarely rely on a single technique, instead layering multiple cheap methods to add delays. The same laundering technique was previously used in the $1.5 billion Bybit hack in 2025, where North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain.
At the time of Elliptic’s analysis, about 11.8 million NEAR tokens stolen in the Binance hack remained unmoved, valued at $43.7 million.