Binance Hack Launderers Mint Elon Musk and Animal Meme Coins to Move Stolen Crypto

North Korea’s hackers have found a novel use for the internet’s favorite joke tokens: laundering a slice of the record $6.4 billion stolen from Binance.

According to a report from blockchain analytics firm Elliptic, the launderers are creating their own worthless meme coins and using them to shuffle stolen funds through decentralized exchanges in a way that breaks the direct onchain link between the thief’s wallet and the one collecting the proceeds.

The launderers mint a brand-new token, pair it with a real asset like Near or a stablecoin in a liquidity pool, pay stolen funds into the pool through one set of wallets to buy the token, then sell it back through a separate set of wallets to withdraw clean-looking assets.

Because the pool sits in the middle, no stolen funds move directly from the buying wallet to the collecting one, and the receiving wallets look like ordinary traders cashing out a meme coin.

Elliptic, in research credited to co-founder Tom Robinson, said the launderers deployed the tactic on Tron and Near, with a close variant on Solana. The clearest example came on Near, where between Nov. 5 and 7 they created at least six home-made tokens, each paired with Near in its own pool.

The coins carried the usual meme-coin trappings: cartoon logos of a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox, one even featuring an “Elon 2028 President” image of Elon Musk, who has no connection to the tokens. The names ran from the crude (FUK) to a riff on dog coins (SINU).

Each token cost about 25 Near tokens, roughly $90, to create. All six followed the same arc: launched, traded heavily within hours using stolen NEAR, then abandoned, with the leftover liquidity pulled on Nov. 8.

In total, about 117,000 Near, or roughly $430,000, passed through the six tokens before much of it flowed into stablecoins or a cross-chain bridge.

The sums are modest so far, a reminder that the bulk of the haul is still parked onchain. Elliptic earlier found more than $3 billion of the stolen crypto had yet to be laundered, and that the launderers were spinning up a new wallet roughly every 25 seconds to move funds at machine speed.

Crucially, the meme-coin trick doesn’t actually hide the money. Elliptic stressed the trail remains fully traceable onchain; the maneuver only slows investigators down, buying time in what is essentially a race to move funds before they get flagged.

It’s one cheap, disposable layer among many that North Korea’s launderers stack together. Elliptic first observed the tactic last year while tracing the $1.5 billion Bybit theft, also attributed to the TraderTraitor group behind the Binance breach.

For compliance teams, the firm warned, funds arriving from a liquidity pool shouldn’t be assumed clean, especially where freshly minted tokens and a handful of trading wallets are involved.