North Korean hackers create memecoins. This is how they hide money stolen from Binance

Hackers linked to North Korea have begun creating their own memecoins to make it harder to track billions of dollars stolen from the Binance exchange. Elliptic analysts discovered six such tokens through which cryptocurrencies worth approximately PLN 430,000 were transferred. USD. One of them even used the image of Elon Musk.

Everything is related to the attack on October 29, during which cryptocurrencies worth approximately USD 6.4 billion were withdrawn from Binance wallets. It was the largest theft in the history of the cryptocurrency market. The FBI attributed the operation to the TraderTraitor group, which operates on behalf of North Korea.

Memecoins that only exist for a few hours

According to a November 9 Elliptic report, criminals launched six tokens on the NEAR network between November 5 and 7. They were named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Their logos depicted, among others, a monkey, a duck, a fox and Elon Musk with the slogan “Elon 2028 President”. Musk had no confirmed connection to the venture.

Tokens were not used for investing or community building. They were created solely to move stolen cryptocurrencies between wallets.

The mechanism used liquidity pools on decentralized exchanges (DEX). Criminals created a new token and pooled it with a real cryptocurrency, e.g. NEAR. One set of wallets then bought the tokens with the stolen funds and the other set sold them in the same pool, receiving NEAR.

As a result, the wallets receiving the funds looked like the accounts of ordinary traders realizing profits from selling memecoins. Direct transfers between criminals’ wallets were replaced by a series of DEX transactions.

The surgery was extremely cheap. Creating one token cost approximately NEAR 25, or $90 according to Elliptic’s valuation. Each of the six memecoins was used within a short period of time and then abandoned. Since November 8, analysts have not recorded any further trading on them.

Researchers also found that virtually all trading came from wallets belonging to the same network. Only the FUK token attracted a small number of external buyers, accounting for less than 1% of its volume.

North Korea has already used a similar scheme

This is not the first time that worthless tokens have been used to hide stolen cryptocurrencies. When laundering funds following the Bybit hack in 2025, criminals used a similar method on the Tron network, moving at least $24 million.

The scale of current activities is much larger, although the use of memecoins remains only a small part of the entire operation.

According to a broader analysis by Elliptic, updated on November 9, the movement of funds stolen from Binance has already included over 20,000. wallets, 16 blockchains and at least 65,000 transaction. About $3 billion was still located at addresses linked to the theft. However, this does not mean that the remaining amount has been paid or successfully laundered.

Importantly, creating your own tokens does not provide anonymity to hackers. All operations leave a public trace on the blockchain. New memecoins only complicate the analysis of flows, forcing investigators to check subsequent wallets and transactions.

The problem also applies to exchanges and companies handling cryptocurrencies. Funds received from a liquidity pool may appear to be legitimate trading proceeds even though they were previously stolen.

Binance declares that it will cover losses resulting from the October hack from its own funds and the SAFU fund. According to the exchange’s announcement on November 3, 98% of the token assets affected by the incident have already been restored. However, this does not mean recovering such a part of the stolen cryptocurrencies.