Elliptic Reports North Korean Threat Actors Using Memecoins for Binance Hack Money Laundering
Cyber criminals with ties to North Korea transferred approximately $430,000 obtained from the Binance breach using six freshly minted NEAR tokens, leveraging liquidity pools to hide the movement of illicit funds.
Cyber criminals associated with North Korea deployed memecoins as a laundering mechanism for digital assets taken during the $6.4 billion Binance security breach, channeling approximately $430,000 through six recently deployed tokens on the NEAR blockchain, as detailed in findings published by blockchain analytics company Elliptic.
During the period spanning Nov. 5 through Nov. 7, the threat actors deployed a minimum of six tokens on NEAR and leveraged liquidity pools across decentralized exchanges to transfer illicit funds between different wallets, according to Elliptic's analysis. The tokens saw virtually no legitimate trading activity from external parties and were discontinued soon after their initial deployment.
The cyber criminals utilized one group of wallets to exchange stolen NEAR tokens for the newly created memecoins, subsequently employing a separate group to liquidate those memecoins back into the pools in exchange for NEAR. This swapping methodology enabled them to transfer funds while avoiding direct wallet-to-wallet transactions, although the activities remained visible and traceable on the blockchain.
Elliptic's investigation also revealed that five out of the six token creators received funding from the proceeds of previous token sales occurring just two to 13 minutes prior to each subsequent launch, creating a connected chain of transactions that linked the tokens together.
North Korea's launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay.
Tom Robinson, Elliptic co-founder
According to Elliptic, this identical laundering methodology was also deployed in the aftermath of the $1.5 billion Bybit hack in 2025, during which North Korean-affiliated threat actors transferred a minimum of $24 million through a freshly created token on the TRON blockchain.
At the point when Elliptic conducted its analysis, approximately 11.8 million NEAR tokens stolen during the Binance hack had not yet been moved. Elliptic calculated the value of those remaining funds at $43.7 million.