North Korean launderers are creating their own worthless meme coins and pushing stolen Binance funds through them so the coins never move directly from one wallet to another, blockchain analytics firm Elliptic said Monday.
Between Nov. 5 and 7, the operators minted at least six new tokens on the NEAR blockchain — named FUK, OLCCL, MEILI, MMLI, DABI and SINU — paired each with NEAR in its own liquidity pool, then bought the tokens with stolen NEAR and sold them back out through a second set of wallets. About 117,000 NEAR, or roughly $430,000, passed through the six tokens, Elliptic wrote.
The trail sits inside the broader laundering of the Oct. 29 Binance theft, which the exchange has put at $6.34 billion and which the FBI has attributed to North Korea’s TraderTraitor group. Elliptic’s wider update now puts roughly 3,000 BTC — about $225 million — in new bitcoin addresses converted from other stolen assets, while about 11.8 million NEAR, or $43.7 million, from the theft has still not moved.
“Most people think of meme tokens as joke coins whose prices rise and fall on hype,” Elliptic co-founder and chief scientist Dr. Tom Robinson wrote. “North Korea’s launderers have found a different use for them.”
How the homemade token trick works
The technique is a four-step hop. The North Korea launderers create a token with a public launch tool, open a liquidity pool pairing it with a real asset such as NEAR or a stablecoin, buy the new token with stolen funds from one set of wallets, then sell it back into the same pool from a second set of wallets that collect the real asset.
At no point do the stolen funds transfer directly from a buying wallet to a collecting wallet, because the pool sits in between. To a casual observer, the collecting wallets look like ordinary traders who sold a token at a profit.
Each of the six NEAR tokens cost about 25 NEAR, or around $90, to create. Each was traded heavily within hours using stolen NEAR and then abandoned. None has traded since Nov. 8, and that afternoon the creators of four of them withdrew what liquidity was left. Five of the six token creators were funded by a wallet that had just sold an earlier token, between two and 13 minutes before the next launch, so the tokens form a chain.
Elliptic first reported the same approach in the laundering of the February 2025 Bybit theft, also attributed to North Korean group TraderTraitor, when a worthless Tron token helped move at least $24 million. In the Binance case the firm has also seen the technique on Tron and a close variant on Solana that used existing thinly traded tokens rather than homemade ones.
A slowing tactic, not a disappearing act
The meme coins do not hide the funds. Every step is public on-chain. What they buy is time. Each extra hop slows investigators while launderers race to move funds before they are flagged, and at about $90 apiece the tokens are cheap enough to throw away.
That fits the larger pattern Elliptic has tracked since the theft: more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. Binance has said the attack began with a fake job interview and ran for five months before any coins moved. Blockchain firms linked the breach to TraderTraitor within a day.
The conversion into bitcoin is the bigger dollar story. All of the stolen SOL has already been swapped, bridged or mixed, and much of the XRP route has fed into bitcoin as well. About $2.85 billion of the original haul has been frozen. A negligible amount has likely been cashed out so far, Elliptic said.
North Korea’s crypto theft machine is not new. Elliptic put the North Korean regime’s 2025 haul above $2 billion, driven by the $1.46 billion Bybit exploit, and its cumulative known total above $6 billion even before Binance.
Binance has reopened withdrawals in stages and said it covered customer losses from its own funds. The test for investigators is whether homemade liquidity pools keep multiplying faster than the blocklists catching up to them.