Binance Hack: North Korea Makes Memecoins to Launder $430,000

Memecoins that don't make anyone laugh. Since the Binance hack in October, North Korea has been unable to launder all of its loot. Analytics company Elliptic revealed on November 9 how hackers made six custom memecoins between November 5 and 7, to hide around $430,000 of the loot.

To launder funds by hiding their tracks, North Korean hackers now use simple liquidity pools. A liquidity pool is a common fund where two cryptocurrencies are exchanged without an intermediary.

In this case, the pool contains NEAR and a memecoin created for the occasion, which no one else wants to buy. The assembly takes place in two transactions. a first wallet buys the memecoin with stolen NEAR, then a second resells it in the pool and leaves with ordinary-looking NEAR.

At no time do stolen funds pass directly from one wallet to another. The pool serves as an airlock, and the collector wallet looks like a trader who has sold his token.

For example, if a platform accepts NEAR taken out of the pool, it sees a customer who sold a memecoin at a profit. Nothing invites him to look at the other side of the cash register, where the money came in.

The six memecoins play chameleons right down to the logo, with a FUK, a SINU, and even a token bearing the image of Elon Musk under an “Elon 2028 President” banner.

Each token costs approximately 25 NEAR, or $90, to put into circulation. At this price, hackers can mass-produce them and throw them away after use.

Elliptic's diagnosis notes a detail, since the network's wallets have achieved the entire volume of the six memecoins. They represented 100% of the volume for five of them.

The only external purchases concern the FUK token and represent less than 1% of its volume on the first day. Each memecoin was massively traded within hours of its launch, then permanently abandoned.

The chain closes on itself. Five out of six tokens were paid by a wallet which was still selling the previous one a few minutes earlier, so that each memecoin finances the next one.

A drop of water in 6.4 billion dollars

After the Bybit hack in 2025, the same group channeled at least $24 million through a worthless token on Tron.

On the Binance side, the series has accelerated since the theft, with a similar token spotted on Tron on November 2, then a variant on Solana the next day. The FBI also ordered THORChain to block $242 million laundered through Tron.

Elliptic explains, this technique is not intended to hide funds, but to slow down those who track them. Each step remains recorded on the blockchain, public and searchable.

Of the $6.4 billion stolen from Binance, these memecoins represent only a fraction, while around 11.8 million NEAR, or $43.7 million, has yet to move.

The token launcher, the exchange platform and the wallet application used did not infringe anything, since the hackers used them like any other user.

The lesson applies to platforms. A wallet powered by a liquidity pool is not clean by default, Elliptic warns, and can be two exchanges away from stolen funds.