North Korea is minting meme coins to launder the Binance hack

The FBI has attributed the October 29 breach of Binance, the largest crypto theft on record, to North Korea's TraderTraitor group. Roughly $6.3 billion was taken, including about 11.8 million NEAR tokens worth $43.7 million that have not yet moved, according to blockchain analytics firm Elliptic. Over three days from November 5 to 7, launderers routed roughly 117,000 NEAR, about $430,000, through six newly minted tokens — FUK, OLCCL, MEILI, MMLI, DABI and SINU — each launched for about 25 NEAR, or around $90.

Each token was paired with NEAR in its own liquidity pool on a decentralized exchange. One group of wallets paid stolen NEAR into the pool for the new token, and a second group sold the token back and pulled NEAR out. Because the pool sits in the middle, no transfer connects the two groups directly. "They exist only to put a pool between the stolen funds and the next wallet," Elliptic wrote on X. Outside traders were almost entirely absent; the laundering wallets themselves placed every sell order in all six tokens and every purchase in five of them, with only a sprinkling of FUK buys on launch day from other addresses.

The tokens carried cartoonish artwork: one showed a monkey sporting a pink bow, another a duck posed against an American flag, and a third put Elon Musk beneath an "Elon 2028 President" banner. Elliptic said there is no suggestion Musk has any link to them. The tokens were also linked in a chain: in five cases, the wallet that bankrolled a new token's creator had been dumping the prior token just 2 to 13 minutes before launch, so profits from one financed the next. None has traded since November 8, and that afternoon four of the tokens' creators pulled the funds still sitting in their pools.

Elliptic said it first saw this technique after Bybit lost $1.5 billion in 2025, when launderers used a worthless Tron token to move at least $24 million. In the Binance case, a similar Tron token appeared on November 2, and a day later stolen SOL went through existing thinly traded Solana tokens. "The technique slows investigators down rather than hiding the funds," Elliptic's Tom Robinson wrote. The firm told compliance teams not to treat funds coming out of a liquidity pool as clean by default, listing warning signs such as tokens only days old, pools with a handful of traders, and wallets that only buy or only sell.

The broader laundering operation has used more than 20,000 wallets and executed at least 65,000 transactions within a week of the hack, equating to roughly one new wallet every 30 seconds and one transaction every 10 seconds, Elliptic said in a November 7 post. Around $3.13 billion remains with the hackers in wallets linked to the theft, mostly in Bitcoin and Ether, which cannot be frozen by their issuers. A further $2.85 billion was either frozen or intercepted, Binance Co-Chief Executive Officer Richard Teng said on a livestream Monday, much of it in stablecoins where issuers like Tether and Circle can stop tokens from being swapped for cash. The attackers have used decentralized privacy-focused networks including THORChain, Privacy Cash and Wasabi Wallet to execute trades.