North Korea Uses Meme Coins to Launder Binance Theft Proceeds

By Elena Vasquez

North Korean launderers used at least six homemade meme tokens on Near to route roughly $430,000 from the record $6.4 billion stolen from Binance, according to a blockchain analytics report from Elliptic. Elliptic credited the research to co-founder Tom Robinson. Its report identified the technique on Tron and Near, plus a close variant on Solana, as North Korea’s operators tried to obscure direct payment links between stolen funds and final recipients.

How does the token scheme work?

The operators create a new token, pair it with an underlying asset such as NEAR or a stablecoin in a decentralized-exchange liquidity pool. They use one group of wallets to buy the token with stolen funds, then sell it through a separate group and withdraw assets that resemble ordinary meme-coin trading.

That is not the same as anonymity: Elliptic said the trail “remains fully traceable onchain,” because investigators can still follow the token, pool and wallet sequence. In plain terms, the pool separates the wallets without removing the evidence.

What happened on Near?

Elliptic called the Near activity the clearest example. Between Nov. 5 and Nov. 7, the launderers created at least six tokens, each with a separate NEAR liquidity pool. Creating each token cost about 25 NEAR, roughly $90, making the mechanism cheap enough to discard.

The tokens carried cartoon logos of a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. Another displayed an “Elon 2028 President” image of Elon Musk, who had no connection to the tokens; the reported names ranged from FUK to SINU, a riff on dog coins.

Each token traded heavily within hours using stolen NEAR, then the operators abandoned it. On Nov. 8, they pulled the remaining liquidity, and about 117,000 NEAR, worth roughly $430,000, had passed through all six tokens before much of the proceeds flowed into stablecoins or a cross-chain bridge.

Elliptic did not report trading volume, holder counts or an organic trading community for the tokens. The evidence supports a laundering mechanism, not a viable token business.

How large is the remaining problem?

The $430,000 remains small compared with the haul: Elliptic previously found that more than $3 billion of the stolen crypto remained unlaundered and parked on-chain. The group was also creating a new wallet roughly every 25 seconds, a machine-speed response that Elliptic described as a race to move funds before they were flagged.

Elliptic first observed the meme-token method in 2025 while tracing the $1.5 billion Bybit theft. That breach was also attributed to TraderTraitor, the group linked to the Binance breach, indicating operational continuity across the two cases.

The current attempt remains one cheap, disposable layer among several that the launderers stack together. The report announced no recovery, arrest or charge arising from the Near tokens. In plain terms, the episode adds delay, not concealment, to a much larger and still-moving problem.

What should compliance teams do?

Elliptic warned that “funds arriving from a liquidity pool shouldn’t be assumed clean,” particularly when a newly minted token and a handful of trading wallets appear together. The warning shifts scrutiny from a wallet’s apparent counterparty toward the token’s creation history, pool behavior and connected wallets.

That guidance does not mean every liquidity-pool withdrawal represents laundering. The markers in this case were specific: freshly created tokens, rapid turnover, separate wallet sets and remaining liquidity withdrawn after launch. Elliptic supplied no broad threshold that compliance systems could apply automatically.

The immediate enforcement window is constrained as investigators try to trace more than $3 billion still on-chain while the launderers create a wallet roughly every 25 seconds. The meme-coin layer can complicate each transfer, but Elliptic’s central finding remains that it does not break the chain of evidence.