North Korean Hackers Laundered $430,000 Through Meme Coins

Elliptic estimated on Nov. 9 that North Korean hacking groups laundered about $430,000 through self-issued meme coins after the $6.4 billion Binance hack.

A wallet holding stolen funds bought a newly issued token. Another wallet sold it and recovered NEAR.

Elliptic traced that method to at least six tokens on the NEAR chain, minted between Nov. 5 and Nov. 7. Issuance cost about $90 per token.

Elliptic identified:

• FUK
• OLCCL
• MEILI
• MMLI
• DABI
• SINU

How did the laundering method work?

The method relied on a liquidity pool on a decentralized exchange. The hackers created that pool using a cryptocurrency with real value, such as NEAR. They bought the token with stolen funds and sold it from another wallet.

The sequence left no direct transfer record between the wallet holding the stolen funds and the wallet that ultimately received the money. To outside observers, the activity could look like ordinary meme-coin trading. Tracing the flow of funds therefore required additional analysis.

Elliptic estimated that about 117,000 NEAR, worth about $430,000, moved through this method. Much of the recovered money was then swapped into stablecoins or moved to other blockchains.

Why did the tokens look disposable?

Trading clustered immediately after issuance and then stopped. None of the six tokens recorded any trading since Nov. 8. The issuer also withdrew some liquidity.

Elliptic concluded the tokens were created for laundering. Most transactions took place between wallets linked to the hacking groups. The pattern gave the activity a narrow window: buying and selling clustered around issuance, with no sustained market afterward.

“This technique does not completely hide funds. It slows investigators down,” Elliptic said. “Because all transaction records remain on the blockchain, tracing the flow of funds is still possible,” the firm added.

Elliptic found a similar case in last year’s Bybit hack. Hackers laundered at least $24 million in stolen funds through self-issued tokens. In the Binance case, a similar token surfaced on TRON on Nov. 2. Fund transfers using thinly traded tokens appeared on Solana the next day.

What does this change for crypto firms?

The low cost means hacking groups can create and discard tokens repeatedly. Each token can carry a portion of stolen funds before it is abandoned. The route adds trading steps without erasing the underlying blockchain records.

Elliptic advised crypto firms not to treat funds entering from liquidity pools as legitimate solely because of their source. That makes the path across wallets the relevant screening issue. A final receipt from a liquidity pool can resemble ordinary market activity. That resemblance can persist even when the token was issued for the transfer itself.

The practical change is operational. Crypto firms need to examine how a token was created, when its trading stopped and which wallets bought and sold it. Those checks matter most when the incoming asset is near-worthless and has no sustained trading history.

Separately, Elliptic said about 11.8 million NEAR, worth $43.7 million, stolen in the Binance hack had yet to move. That balance is the next trace for investigators. If it moves, compliance teams will face a clear test: spotting liquidity-pool inflows before stolen funds reach stablecoins or another blockchain.