Binance Hackers Laundered $430,000 Through Self-Made Memecoins

Blockchain analytics firm Elliptic has documented a previously unseen laundering method tied to the theft of cryptocurrency from Binance: attackers with suspected North Korean links cycled roughly 117,000 NEAR tokens, worth about $430,000 at the time, through six memecoins they created themselves.

The finding comes from Elliptic's on-chain research into the Binance attack. According to the firm, the attackers did not simply move stolen funds from wallet to wallet. Instead, they built a trading scheme designed to disguise the proceeds as legitimate memecoin profits.

The mechanics were deliberate and layered.

• The attackers created six memecoins between November 5 and November 7.
• For each token, they set up a separate NEAR liquidity pool on a decentralized exchange.
• One cluster of wallets used the stolen NEAR to buy the memecoins.
• A second cluster of wallets then sold those same memecoins back into the pools, retrieving NEAR.

The result, per Elliptic, is that the funds no longer appear as a direct transfer connected to the hack. On the ledger, the trail looks like a string of successful memecoin trades — someone bought low, sold high, and walked away with NEAR.

Why does this matter for tracing stolen funds?

Laundering through decentralized exchanges is not new. But Elliptic describes this particular construction as unprecedented in its specifics: the attackers controlled both sides of the market. They issued the tokens, supplied the liquidity, and populated both the buying and selling wallets.

That control is what makes the scheme effective. Conventional tracing leans on following assets between addresses tied to an attack. Here, the intermediate step — the memecoin trades — inserts a layer of plausible commercial activity between the theft and the cash-out, making the NEAR look earned rather than stolen.

What does this change for exchanges and investigators? It raises the cost of attribution. Analysts now have to distinguish organic memecoin trading from coordinated wash-style round-trips, a harder problem on permissionless exchanges where anyone can mint a token and seed a pool in minutes.

Who is behind it?

Elliptic attributes the activity to attackers believed to have North Korean links. The firm did not name a specific group in its disclosed findings. The Binance theft itself, and the total amount taken in the broader incident, sit outside the scope of the transactions Elliptic detailed in this research.

The documented portion is narrow but instructive: roughly 117,000 NEAR, about $430,000 in value at the time of the transactions, pushed through six freshly minted tokens over a three-day creation window in early November.

What comes next?

Expect analytics firms and exchanges to refine their screening for exactly this pattern — newly created tokens, single-sided liquidity provision, and paired buy-and-sell wallet clusters moving stolen assets through decentralized venues. As on-chain forensics firms close the gap on this method, attackers will keep searching for the next one.