---
title: "North Korea Mints Disposable Meme Coins to Launder Stolen Binance Funds, Elliptic Says"
description: "Blockchain forensics firm Elliptic tracked 117,000 NEAR moved through single-use liquidity pools on Tron, Solana, and NEAR."
url: https://basisdesk.news/news/north-korea-meme-coins-launder-binance-hack-elliptic
published: 2026-11-09T18:01:43.416Z
modified: 2026-11-09T18:01:43.416Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [NEAR, SOL, USDC]
tags: [north-korea, binance, elliptic, meme-coins, anti-money-laundering, near-protocol]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# North Korea Mints Disposable Meme Coins to Launder Stolen Binance Funds, Elliptic Says

Blockchain forensics firm Elliptic tracked 117,000 NEAR moved through single-use liquidity pools on Tron, Solana, and NEAR.

## At a glance

- **What happened:** Elliptic reported that North Korean hackers minted throwaway meme coins on NEAR, Tron, and Solana to launder funds from the $6.4 billion Binance hack.
- **Why it matters:** Using decentralized pools as intermediaries severs direct transaction links between attacker deposit wallets and collecting addresses, slowing down tracing efforts.
- **Who is affected:** Compliance teams, automated transaction-monitoring providers, and decentralized exchange liquidity venues.
- **What's next:** Monitoring of 11.8 million unspent stolen NEAR as analytics firms update real-time screening blocklists.
- **Primary source:** [North Korea is minting meme coins to launder the Binance hack](https://www.elliptic.co/insights/north-korea-meme-coins-binance-hack) — elliptic.co

## Key points

- North Korean actors launched six single-use meme tokens on NEAR to launder $430,000 in stolen crypto from the $6.4B Binance breach.
- Launderers swap stolen assets into bespoke DEX pools and withdraw from separate collecting wallets to sever direct wallet links.
- Elliptic identified similar meme coin and token pool laundering patterns on Tron and Solana, while 11.8M NEAR remains unspent.

## Editorial remark

- **Context:** The activity stems from the October 2026 $6.4 billion Binance exploit, which US authorities and blockchain analytics firms attributed to North Korea's cybercrime apparatus.
- **Impact:** Decentralized exchanges, bridge protocols, and centralized compliance desks face heightened tracking difficulties as attackers break direct on-chain links using bespoke pools.
- **Watch:** Movement across the remaining 11.8 million stolen NEAR ($43.7 million) and subsequent updates to public transaction screening blocklists.

North Korean hackers are minting disposable meme tokens to launder proceeds from the $6.4 billion Binance exploit, according to an analysis published by Elliptic on Nov. 9 [1]. The state-backed group is routing stolen funds through decentralized exchange liquidity pools, separating source wallets from collector addresses to evade automated compliance tracking [1]. The maneuver follows earlier findings by investigators linking the Binance drain to [North Korea's TraderTraitor unit](https://basisdesk.news/news/trm-labs-binance-hack-north-korea-tradertraitor) [1].

Between Nov. 5 and Nov. 7, the laundering network deployed at least six bespoke meme tokens on the NEAR blockchain, including assets named FUK, MEILI, and SINU, costing roughly 25 $NEAR ($90) each to launch [1]. The operators paired each token with NEAR in private liquidity pools, funneled roughly 117,000 stolen NEAR ($430,000) into the pools via buying wallets, and extracted equivalent value through secondary selling wallets [1]. The extracted balances were promptly converted into stablecoins or moved across cross-chain bridges before the pools were drained and abandoned on Nov. 8 [1].

## Cross-Chain Layering

Elliptic noted that the NEAR transactions mirror similar tactics observed on Tron on Nov. 2 and Solana on Nov. 3, as well as a 2025 laundering campaign that processed $24 million stolen from Bybit [1]. While the meme coin mechanism does not erase on-chain records, Elliptic emphasized that it acts as a low-cost obfuscation layer designed to buy time against forensic blacklists [1]. 

The technique has processed only a fractional slice of the broader haul, leaving roughly 11.8 million stolen NEAR ($43.7 million) dormant in attacker wallets [1]. Elliptic warned compliance teams that incoming decentralized exchange swaps should not be classified as clean simply because they originate from liquidity pool smart contracts [1].

## Sources

1. [North Korea is minting meme coins to launder the Binance hack](https://www.elliptic.co/insights/north-korea-meme-coins-binance-hack) — elliptic.co, 2026-11-09

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai