TL;DR: Blockchain analytics firm Elliptic says North Korean hackers behind the record Binance hack have started washing stolen funds through six homemade memecoins, built and dumped between November 5 and November 7. So far about 117,000 NEAR, roughly $430,000, has moved through the scheme. It’s a scaled-down version of a laundering trick the same group used to move at least $24 million after last year’s Bybit hack, and it shows North Korea is still actively cashing out from the $6.3 billion Binance breach three weeks later.
A money laundering trick disguised as a trading boom
Elliptic co-founder Tom Robinson laid out the mechanics in a report published November 9: the hackers mint a brand-new token on a public launch tool, pair it with a real asset like NEAR or a stablecoin in a decentralized exchange liquidity pool, then run both sides of the trade themselves. One set of wallets buys the new token using stolen funds. A second set sells it back and walks away with clean-looking proceeds.
“The launderers made six of these crypto tokens, and traded them only with themselves,” Robinson told CoinDesk. “That makes the stolen funds look like trading proceeds.”
Because a liquidity pool sits between the buying wallets and the selling wallets, there’s no direct on-chain link connecting the two. Anyone glancing at the transaction history sees what looks like ordinary token speculation instead of a hacker cashing out.
The numbers behind the wash cycle
Elliptic identified at least six tokens on NEAR Protocol, with names including FUK, OLCCL, MEILI, MMLI, DABI and SINU. The first, FUK, went live at 12:25 a.m. UTC on November 5. Four more followed on November 6, and the last, SINU, launched the morning of November 7. Each one cost the hackers only about 25 NEAR, roughly $90, to create.
About 117,000 NEAR flowed into the buying wallets, and nearly the same amount came back out the other side, much of it converted into stablecoins or pushed across a cross-chain bridge. At current prices that’s close to $430,000, a modest sum against the size of the original theft, but Elliptic notes that roughly 11.8 million NEAR, worth about $43.7 million, from the hack still hasn’t moved at all.
The forensic trail is unusually clean for a laundering operation. Wallets inside the same network accounted for every single sale across all six tokens, and bought up every unit of five of them. Outside traders made up less than 1% of volume on the one token that saw any real public interest. Each coin stopped trading entirely by November 8, and the creators of four of them pulled the remaining liquidity out of their pools that same afternoon, like turning off the lights after closing up shop.
One of the tokens briefly used an image of Elon Musk under an “Elon 2028 President” banner. Elliptic was careful to note there’s no indication Musk or his team had anything to do with the token, which is exactly the kind of borrowed-legitimacy trick memecoin scammers lean on constantly.
Not their first laundromat
This isn’t a new playbook for North Korea’s hacking units. Elliptic says it caught a near-identical scheme on Tron following the February 2025 Bybit hack, where the same wash-trading structure moved at least $24 million, more than fifty times what’s shown up in the Binance case so far. The group has also been spotted creating a worthless token on Tron on November 2 and swapping stolen Solana through thinly traded existing tokens on November 3 before converting everything to USDC.
Taken together, it paints a picture of a laundering operation that treats memecoin creation as just another tool in the kit, alongside the THORChain bitcoin swaps and cross-chain bridges the hackers have reportedly leaned on elsewhere in this same breach.
Binance’s hack keeps getting messier by the week
The underlying theft, which investigators have pinned on North Korea’s TraderTraitor group, happened on October 29 and remains the largest crypto exchange hack on record, with the total loss cited anywhere from $6.3 billion to $6.4 billion depending on the asset prices used in the calculation. We broke down how investigators traced the breach back to a fake job interview and a compromised internal AI tool shortly after it happened, and the fallout has kept piling up since. Barely a week after the hack went public, Binance’s chief financial officer Kaiser Ng left the company, a departure the exchange insisted was unrelated timing.
Now the memecoin laundering adds another layer: even as Binance, exchanges and law enforcement try to freeze what they can, a meaningful chunk of the stolen money is already working its way through decentralized exchanges that don’t ask questions and don’t have a compliance department to call.
Why DEXs make this nearly impossible to stop in real time
A centralized exchange like Binance or Coinbase can freeze an account the second compliance flags it. A decentralized exchange can’t, because there’s no account to freeze and no company running the show. Anyone with a wallet and a few dollars in gas fees can spin up a token and a trading pool, and the smart contract executes whatever trade gets submitted without checking who’s on the other end.
That’s exactly the gap North Korea’s hackers are exploiting. By the time Elliptic published its findings, all six tokens had already stopped trading and most of the liquidity had been pulled. Investigators can map the flow of funds after the fact, which is how this got caught at all, but there’s no mechanism to freeze a DEX pool mid-trade the way a bank or exchange can freeze a wire transfer. The best defense right now is the same one Elliptic used here: watching wallet behavior closely enough to flag a network of addresses trading suspiciously only with itself, then warning other exchanges and bridges before the funds land somewhere harder to trace.
The bottom line
Six fake tokens and $430,000 is small change next to a $6.3 billion heist, but that’s precisely why this story matters. It shows North Korea’s hackers don’t need a sophisticated new exploit to launder money at scale. They just need a few dollars in gas fees, a DEX that will list anything, and patience. Elliptic caught this batch because the wash trading pattern was almost comically self-contained, but the group has had a year of practice since Bybit to get better at hiding the seams. The $43.7 million still sitting untouched from the Binance haul is the number worth watching next.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
