North Korea Mints Disposable Meme Coins to Launder Stolen Binance Funds, Elliptic Says

North Korean hackers are minting disposable meme tokens to launder proceeds from the $6.4 billion Binance exploit, according to an analysis published by Elliptic on Nov. 9 ¹. The state-backed group is routing stolen funds through decentralized exchange liquidity pools, separating source wallets from collector addresses to evade automated compliance tracking ¹. The maneuver follows earlier findings by investigators linking the Binance drain to North Korea's TraderTraitor unit ¹.

Between Nov. 5 and Nov. 7, the laundering network deployed at least six bespoke meme tokens on the NEAR blockchain, including assets named FUK, MEILI, and SINU, costing roughly 25 $NEAR ($90) each to launch ¹. The operators paired each token with NEAR in private liquidity pools, funneled roughly 117,000 stolen NEAR ($430,000) into the pools via buying wallets, and extracted equivalent value through secondary selling wallets ¹. The extracted balances were promptly converted into stablecoins or moved across cross-chain bridges before the pools were drained and abandoned on Nov. 8 ¹.

Cross-Chain Layering

Elliptic noted that the NEAR transactions mirror similar tactics observed on Tron on Nov. 2 and Solana on Nov. 3, as well as a 2025 laundering campaign that processed $24 million stolen from Bybit ¹. While the meme coin mechanism does not erase on-chain records, Elliptic emphasized that it acts as a low-cost obfuscation layer designed to buy time against forensic blacklists ¹.

The technique has processed only a fractional slice of the broader haul, leaving roughly 11.8 million stolen NEAR ($43.7 million) dormant in attacker wallets ¹. Elliptic warned compliance teams that incoming decentralized exchange swaps should not be classified as clean simply because they originate from liquidity pool smart contracts ¹.