North Korean Hackers Used Memecoins to Launder $6.4B Binance Heist

Elliptic reported that North Korean hackers used newly minted memecoins on NEAR to launder stolen $NEAR linked to a $6.4 billion Binance heist. The strategy did not erase the funds’ blockchain history; it inserted extra transactions, disposable tokens and separate wallets between the theft and the withdrawal of proceeds in another form.

Chainalysis attributed the record-setting hack to TraderTraitor, a North Korean cybercrime group believed to operate under the state-sponsored hacking outfit Lazarus Group. Elliptic’s account focused on homemade meme tokens associated with Elon Musk, Chimpanzees and “FUK,” and on how the hackers used those tokens as temporary instruments in a multi-step liquidity-pool scheme.

The laundering sequence

On NEAR, the hackers first moved stolen $NEAR into one set of wallets. Those wallets paid the assets into different liquidity pools and received newly minted memecoins in return. A different set of wallets then sold the memecoins back into the pools and withdrew real crypto assets.

That sequence created a circular path between the stolen asset, the pools and the new tokens. It also divided the operation across wallet sets: one side supplied the pool deposits, while another disposed of the tokens and made the withdrawals. Elliptic’s researchers could still follow the transfers, but each additional hop increased the time required to reconstruct them.

The same technique appeared on Tron (TRX). On Solana (SOL), the hackers used a similar approach with preexisting but thinly traded tokens. The Solana variation used those existing tokens rather than newly created meme assets. Across all three networks, the operational objective remained the same: add delay between the origin of the funds and their movement beyond the pools.

What does this change for on-chain investigators?

Tom Robinson, Elliptic’s chief scientist and co-founder, put the distinction plainly:

“It does not hide the funds so much as slow down the people tracing them. Each extra hop takes time to unpick, and laundering is a race to move funds before they are flagged.”

The important consequence is not that memecoins defeat tracing. Robinson said the hackers’ transfers remained trackable on blockchains. The technique shifts the burden toward speed: investigators must identify the pool deposits, the newly issued or thinly traded tokens, the sales from the second wallet set and the subsequent withdrawals before that delay becomes large enough to obscure the next stage.

Robinson also described why the tokens fit the scheme. In his assessment, the relevant tokens were cheap, at about $90 each on $NEAR, allowing the launderers to make many and discard each one after use. He said:

“North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay. Home-made meme tokens are simply one more layer.”

That layering makes the scheme harder to dismiss as a single trade or isolated wallet event. The purchase of a memecoin sits inside a larger process that moves the proceeds of the heist toward a withdrawal. The token name is only one component; the relationships among wallets, pools and chain transfers provide the evidentiary path.

For investigators, the practical change is to treat token creation, liquidity-pool activity and cross-wallet transfers as one sequence rather than separate alerts. On NEAR and Tron, the test is specific: funds enter a wallet set, acquire newly minted memecoins through pools, pass to another wallet set and emerge as another crypto asset. On Solana, investigators can apply the analogous test to preexisting, thinly traded tokens.

Going forward, the relevant enforcement window is the interval between the pool deposits and the withdrawals, because the strategy is designed to exploit the time investigators need to connect those hops before the funds move again.