North Korean Hackers Use Cheap Meme Coins to Hide Binance Loot

North Korean launderers are creating worthless, disposable meme coins to shuffle stolen funds from the massive Binance hack through decentralized exchanges. By using these tokens as intermediaries, the hackers break the direct on-chain link between their theft and the final receiving wallets, making the movement look like ordinary trading.
- Between November 5 and November 7, hackers moved roughly 117,000 NEAR, worth about $430,000, through six new tokens, according to Bitcoin Magazine.
- The FBI attributed the October 29 Binance theft to the North Korean group TraderTraitor, as reported by News Bitcoin.
- Approximately 3,000 BTC, valued at about $225 million, has been converted from stolen assets into new bitcoin addresses, according to Blockonomi.
How do the hackers use meme coins to hide money?
The laundering process relies on a four-step cycle designed to create distance between wallets. First, the North Korean actors mint a new token using public tools. Second, they pair this token with a real asset, such as NEAR or a stablecoin, in a liquidity pool.
Third, one group of wallets uses stolen funds to buy the new token from the pool. Finally, a second group of wallets sells the token back into the same pool to collect the real asset. Because the liquidity pool sits in the middle, no stolen funds ever move directly from a buying wallet to a collecting wallet. To an observer, the receiving wallets appear to be nothing more than regular traders cashing out a meme coin for a profit.
This method is extremely cheap. Each of the six NEAR tokens identified by Blockonomi cost only about 25 NEAR, or roughly $90, to create. The hackers can simply repeat this process with new tokens whenever they need to move more money.
What kind of tokens are they creating?
The tokens used in these operations carry typical meme-coin imagery, including cartoon animals and political figures. One token featured a monkey wearing a pink bow, another showed a duck in front of an American flag, and a third displayed an image of Elon Musk under an "Elon 2028 President" banner. Experts note there is no connection between the billionaire and these tokens.
The names of the tokens ranged from crude labels like FUK to variations of popular dog-themed coins, such as SINU. Other names identified in the investigation include OLCCL, MEILI, MMLI, and DABI. These tokens were highly active for only a few hours before being abandoned. On November 8, the creators of four of these tokens withdrew whatever liquidity remained in the pools.
The tokens are often linked in a chain. In five of the six cases, the wallet that funded a new token's creator had sold a previous token only 2 to 13 minutes before the next launch. This shows a coordinated, automated sequence of events.
Is this a new tactic for North Korea?
No, this approach is part of a growing pattern of using cheap, disposable layers to obstruct investigators. The blockchain analytics firm Elliptic first observed this specific technique during the Bybit theft in early 2025, where a worthless Tron token helped move at least $24 million. In the current Binance case, the firm has seen similar variants on the Tron and Solana blockchains.
While the technique is effective at creating delays, it does not truly hide the money. Every transaction remains visible on the public blockchain. The goal is not to make the funds invisible, but to buy time. The hackers race to move assets before they are flagged by security services.
"Most people think of meme tokens as joke coins whose prices rise and fall on hype. North Korea’s launderers have found a different use for them,"
stated Dr. Tom Robinson, co-founder and chief scientist at Elliptic.
Robinson further explained that North Korean launderers rarely rely on a single method. Instead, they stack many low-cost techniques together to add layers of delay to the investigation.
How much money was stolen in the Binance hack?
The scale of the theft is massive. The exchange has valued the October 29 attack at roughly $6.34 billion. While the NEAR-based meme coin tactic only accounts for a small fraction of the total, it represents a sophisticated part of a much larger laundering operation involving thousands of wallets and multiple blockchains.
The current status of the stolen funds is as follows:
- Approximately $2.85 billion of the original haul has been frozen, according to Bitcoin Magazine.
- About $225 million in bitcoin has been moved into new addresses after being converted from other stolen assets.
- Roughly $43.7 million worth of NEAR, or 11.8 million tokens, has not yet moved.
- About $15 million worth of ether was traced into Tornado Cash, a crypto mixer.
Binance has stated that it covered customer losses using its own funds and has been reopening withdrawals in stages.
How do the two sides view the responsibility for the hack?
There is a sharp disagreement between Western intelligence agencies and the North Korean government regarding who is behind the theft.
The FBI and blockchain firms like Chainalysis have attributed the attack to TraderTraitor, a state-sponsored North Korean hacking group. They point to the sophisticated nature of the attack and the specific patterns of fund movement as evidence of a state-level operation.
North Korea has officially denied any involvement. On November 3, Kim Yo-jong, the sister of leader Kim Jong Un, responded to the accusations. She described the claims made by the FBI as a "grave political provocation" designed to damage the reputation of the country.
What happens next for investigators?
The primary challenge for compliance teams is the speed at which these "homemade" liquidity pools appear. Because the cost to create them is so low, hackers can launch new tokens faster than many automated blacklists can update. Security firms are now warning that funds arriving from a liquidity pool should not be assumed "clean" by default.
Investigators will continue to monitor the 11.8 million NEAR that remains stationary and track the movement of the billions in assets that have yet to be fully laundered. The race continues between the automated tools used by the hackers and the blockchain analytics firms trying to freeze the assets.
Frequently Asked Questions
What is a liquidity pool in crypto?
A liquidity pool is a collection of funds locked in a smart contract that allows users to trade one cryptocurrency for another on decentralized exchanges.
Why are meme coins being used for crime?
They are extremely cheap to create and can be used to create "middleman" steps in a transaction, making it harder to trace the direct path of stolen money.
Is the Binance hack still ongoing?
The theft occurred on October 29, but the laundering process is ongoing as hackers continue to move and convert the stolen billions across different blockchains.
SEO Meta Description: North Korean hackers are using $90 meme coins to launder stolen funds from the $6.3B Binance hack, breaking the direct link between theft and recipient wallets.
URL Slug: north-korea-meme-coin-binance-hack-laundering
Sources
- 1.bitcoinmagazine.comNorth Korea Is Minting Its Own Meme Coins to Launder Binance Hack Loot
- 2.blockonomi.comNorth Korean Hackers Used $90 Meme Coins to Launder Stolen Binance Crypto, Elliptic Says
- 3.decrypt.coBinance Hack Launderers Mint Elon Musk and Animal Meme Coins to Move Stolen Crypto
- 4.news.bitcoin.comNorth Korea's $6.3B Binance Hack Takes a Strange Turn With Meme Coins
- 5.bloomingbit.io"北, 바이낸스 해킹 자금 세탁에 자체 밈코인 활용…43만달러 이동"


