North Korean hackers have turned to an unusual tactic to launder stolen cryptocurrency from the record-breaking $6.4 billion Binance breach. According to blockchain analytics firm Elliptic, the launderers are creating their own meme coins and using them to obscure the trail of stolen funds through decentralized exchanges.
The process involves minting a new token, pairing it with a real asset like Near or a stablecoin in a liquidity pool, and then using stolen funds to buy and sell the token through separate wallets. This breaks the direct onchain link between the thief’s wallet and the recipient, making the funds appear cleaner. Elliptic observed this technique on Tron, Near, and a close variant on Solana.
On Near, between November 5 and 7, the launderers created at least six disposable tokens, each with cartoonish logos featuring a monkey, duck, chimpanzee, fox, and even an image of Elon Musk with the caption “Elon 2028 President.” Each token cost around $90 to mint. The tokens were traded heavily using stolen Near tokens before being abandoned, with leftover liquidity pulled on November 8.
While the sums laundered through these meme coins are modest, around $430,000, they represent a small fraction of the $3 billion-plus still unlaundered from the Binance hack. Elliptic emphasized that the trail remains traceable, but the tactic buys time for the launderers, a strategy first seen in the 2025 Bybit theft. The firm warned compliance teams that funds arriving from liquidity pools involving freshly minted tokens should not be assumed clean.