North Korea-Linked Launderers Use Throwaway Memecoins to Move Binance Hack Funds
Blockchain analytics firm Elliptic says North Korea-linked operators created six throwaway memecoins on NEAR to move about $430,000 of funds from the $6.34 billion Binance theft through liquidity pools. Elliptic says about $2.85 billion of the haul has been frozen and only a negligible amount has likely been cashed out.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
The Memecoin Method
Elliptic reported on Nov. 9 that operators minted six new tokens on NEAR between Nov. 5 and 7, named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each cost about 25 NEAR, or roughly $90, to create. The operators paired each token with NEAR in its own liquidity pool, then routed about 117,000 NEAR, or roughly $430,000, through the pools.
The mechanics separate the buying and collecting wallets. One set of wallets bought the tokens with stolen funds, and a second set sold back into the same pool and collected the real asset. Because the pool sits between them, no funds move directly from one wallet to the other, and the collecting wallets can look like ordinary traders taking profits. Elliptic wrote that the trail is still visible on-chain, and warned compliance teams not to assume funds are clean because they arrived from a liquidity pool.
Scope of the Laundering
Elliptic's separate tracker, updated Nov. 9 at 13:15 UTC, counts more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. Similar activity appeared on Tron, and a Solana variant used existing thinly traded tokens instead of homemade ones. Elliptic had previously identified the same technique in the laundering of the February 2025 Bybit theft, where a worthless Tron token helped move at least $24 million.
Bitcoin Conversions and Frozen Assets
The larger dollar movements sit in conversions rather than the meme tokens. Elliptic's tracker shows roughly 3,000 BTC, about $225 million, accumulated in new addresses after conversions from other stolen assets, while the main Bitcoin and Ether holdings had not moved. Since Nov. 8, wallets linked to the theft have deposited about 7,000 ETH, valued at $15 million, into Tornado Cash.
Sources differ on the size of the remaining pool. Elliptic's tracker, as summarized by Crypto.news, puts roughly $3 billion in theft-linked addresses with $2.85 billion frozen. Bitcoin Magazine, citing the same firm's wider update, describes about 11.8 million NEAR, or $43.7 million, as not yet moved. The two accounts describe different slices of the holdings, and neither reports a reconciled total. Both agree that a negligible amount has likely been cashed out.
Attribution and the Breach
The FBI attributed the theft to North Korea's TraderTraitor group on Oct. 31 and urged services, including THORChain operators, to block linked transactions. Binance has put the loss at $6.34 billion and said it set aside more than the full amount to cover losses. Its Nov. 3 account describes a months-long intrusion that began with a fake recruitment interview and malicious code that evaded endpoint security. Crypto.news reports that the attacker later reached wallet engineers' machines and used stolen container deployment credentials to access signing operations. Binance's initial investigation found no evidence of a leaked wallet private key. Separate analysis from Blockaid described malicious EIP-7702 authorizations submitted in one transaction, one of which matched the Binance 14 wallet's transaction counter.
Recovery and Context
On Nov. 5 Binance requested the return of frozen assets, including 8,425.997 ETH and 74.56 million ARB immobilized on Arbitrum. Binance has reopened withdrawals in stages. Elliptic put North Korea's 2025 theft total above $2 billion, driven by the $1.46 billion Bybit exploit, and its cumulative known total above $6 billion even before the Binance incident.
Why It Matters
For Traders
Liquidity pools on NEAR, Tron and Solana may see abrupt activity spikes as laundering continues, so new thinly traded tokens carry elevated manipulation and exit risk.
For Investors
Repeated North Korea-linked thefts above $6 billion underscore sustained state-level pressure on centralized exchanges and the recovery prospects for frozen funds.
For Builders
Malicious EIP-7702 authorizations and liquidity pool routing show that wallet signing flows and token launch tooling need stricter authorization checks and monitoring.
This article is for information only and is not financial advice. Read the full disclaimer.
