North Korean Launderers Use Meme Coins to Move Binance Hack Proceeds

North Korean money launderers are creating disposable meme coins to move cryptocurrency stolen in the record-breaking Binance hack, according to blockchain analytics firm Elliptic. An estimated $6.3 billion was stolen.

In a November 9 report, the blockchain analytics company said six tokens created on the NEAR blockchain between November 5 and 7 were used to move about 117,000 NEAR, worth approximately $430,000. Each cost around $90 to launch.

Logos on the meme coins include a monkey wearing a bow, a chimpanzee, a duck in front of a flag of the United States, a fox, and Elon Musk beneath an “Elon 2028 President” banner. Elliptic said there was no suggestion Musk was connected to the tokens.

This laundering scheme uses decentralized exchange liquidity pools to move assets between wallets without direct transfers between the buying and collecting wallets. One set of wallets buys the tokens with stolen funds. Another sells tokens into the same pools and withdraws the underlying cryptocurrency.

Elliptic identified the technique on Tron and a variation of it using thinly traded tokens on Solana.

The Binance theft occurred on October 29, when attackers drained wallets across multiple blockchains. The FBI attributed the theft to North Korean activity it tracks as TraderTraitor.

The meme tokens were discarded soon after use. None of the six NEAR tokens had traded since November 8, Elliptic said.

The transactions remain publicly traceable, and investigators can follow the swaps through the liquidity pools to link the receiving wallets to the stolen funds. 

Elliptic warned compliance teams against treating funds from liquidity pools as clean. Warning signs include trading concentrated between a few wallets and proceeds from one token financing the launch of another.