North Korea launders Binance hack funds through six throwaway memecoins

North Korean launderers minted six memecoins between 5 and 7 November and traded them only among themselves to move money from the Binance hack, Elliptic reported on Monday. About 117,000 NEAR, roughly $430,000, went through the tokens.

That is a tiny share of the $6.3 billion stolen on 29 October, and you can still follow it onchain. Elliptic’s concern is the price: each token took about 25 NEAR, around $90, to create, and the launderers can drop it after one use.

How the memecoin laundering worked

Each token got its own liquidity pool, paired with NEAR, on a DEX. One set of wallets bought the token with stolen NEAR. A second set sold it back for NEAR. No money passed directly between the two sets, so the second set’s proceeds look like trading profit.

“The launderers made six of these crypto tokens, and traded them only with themselves.”

— Tom Robinson, co-founder and chief scientist at Elliptic, CoinDesk

Quote source: CoinDesk, 9 November 2026.

The tokens carried ordinary memecoin branding: a monkey with a pink bow, a duck in front of a US flag, Elon Musk under an “Elon 2028 President” banner. Elliptic says nothing suggests Musk has any connection to them. It dates their creation like this:

• FUK: 5 November, 00:25 UTC;
• OLCCL, MEILI, MMLI and DABI: 6 November, between 07:19 and 14:27 UTC;
• SINU: 7 November, 10:06 UTC.

What gave the tokens away

A popular wallet app generated random wallet names, so Elliptic linked the wallets through their funding. It lists these tells:

• laundering wallets made every sale of all six tokens and bought every unit of five of them;
• outsiders appear only in small FUK purchases on its first day, under 1% of its volume;
• DABI, MMLI and SINU had one buying wallet and one selling wallet each;
• five of the six creators got their funds from a wallet already selling an earlier token, 2 to 13 minutes before launch.

None of the six has traded since 8 November. That afternoon, the creators of four tokens withdrew the remaining liquidity. Almost the same amount of NEAR left the selling wallets soon after, much of it into stablecoins or over a bridge.

Why a small sum still matters

Elliptic saw the same idea on Tron after the 2025 Bybit hack, when at least $24 million moved this way, and again on Tron on 2 November in the Binance case. About 11.8 million NEAR, some $43.7 million, had not moved when the report came out, and Elliptic says the method could handle much larger sums.

The FBI blames the theft on TraderTraitor, a North Korean group, and Elliptic uses the same attribution. Pyongyang calls the FBI finding a political provocation.

If you work in compliance, Elliptic’s advice is to ask what went into a pool, not only who paid out, and to re-screen deposits you already accepted as its public blocklist grows. If you trade small tokens yourself, look at the trade history before you buy. A coin a day old with heavy volume, few wallets, and wallets that only buy or only sell fits this pattern, and the laundering wallets may be the only other side of your trade.

Based on Elliptic’s report and CoinDesk, checked on 9 November 2026. Elliptic values the theft at $6.4 billion, CoinDesk at $6.3 billion. This is information, not investment advice.