North Korea's Binance Hack Launderers Turn to Made-to-Order Meme Coins

Launderers behind the $6.3 billion Binance hack have adopted a new disguise: worthless meme coins minted solely to move stolen funds, according to Elliptic co-founder and chief scientist Tom Robinson, who detailed the technique on Nov. 9.

Robinson said most people treat meme tokens as joke assets driven by hype. North Korea's operators found a darker use. "North Korea's launderers have found a different use for them, creating tokens that nobody else wants to buy and using them to disguise the movement of stolen funds," he wrote.

The scheme ran across three chains, each with a different twist. On Tron and Near, the launderers created brand-new tokens; on Solana they recycled existing, thinly traded assets.

How does the meme-coin layer work?

On Near, one group bought freshly launched tokens with stolen cryptocurrency through liquidity pools. Other wallets then sold into the same pools and collected nearly matching proceeds. That split the sending and receiving addresses, breaking the visible trail.

The numbers were small but deliberate. Six tokens created between Nov. 5 and Nov. 7 handled roughly 117,000 NEAR, about $430,000, with almost no outside trading. Each launch cost around $90. Five of the creators received funding from earlier token sales shortly before launching replacements, suggesting a rolling production line of throwaway assets.

Elliptic flagged a worthless Tron token built solely for laundering on Nov. 2. Stolen solana moved through thinly traded tokens the next day. The firm previously traced at least $24 million through a similar scheme after the 2025 Bybit theft.

Robinson described the approach as deliberately layered: "North Korea's launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay. Homemade meme tokens are simply one more layer."

Who is behind the hack?

The FBI attributed the Oct. 29 Binance theft to North Korea on Oct. 31, naming the operation Tradertraitor, a state-sponsored group that targets cryptocurrency businesses.

North Korea rejected the accusation on Nov. 3. Kim Yo-jong, sister of leader Kim Jong Un, called the FBI's claims a "grave political provocation" intended to damage the country's reputation.

Chainalysis reached the same attribution independently. It found stolen Binance assets mixing with proceeds from September's Bitget theft, based on blockchain activity observed in the hours after the attack.

The attackers also raced against issuer freezes. In under 20 minutes, they converted $325 million in stablecoins into roughly $285 million of ether, a chain where issuers cannot freeze balances.

How far have the funds moved?

The scale keeps growing. By Nov. 2, stolen assets had passed through roughly 12,000 wallets across 11 blockchains. A Nov. 7 update counted more than 20,000 wallets, 16 blockchains and at least 65,000 transactions.

Elliptic tracked conversions into roughly 2,300 bitcoin, worth $175 million at the time, from assets including solana, XRP and tron. By Nov. 9, converted proceeds had reached about 3,000 bitcoin, worth $225 million.

Around 7,000 ether, about $15 million, went into Tornado Cash, the mixer that lets pooled deposits withdraw to fresh addresses. Elliptic estimated only a negligible share of the total had likely been cashed out so far.

The automation behind it looks conventional, not intelligent. Fixed timing and blind retries of failed operations pointed to standard scripts, and Elliptic found no evidence of AI-directed decisions.

For compliance teams, Robinson's warning resets a basic assumption: "A wallet that received its funds from a liquidity pool should not be treated as clean by default, as it may sit just two swaps away from stolen funds."

With more than $6 billion still in motion and only a sliver cashed out, the laundering operation remains active, and exchanges face a widening screening burden in the weeks ahead.