North Korean hackers create memecoins to launder funds from Binance hack: Elliptic
Blockchain analytics firm reports roughly $430,000 moved through six NEAR tokens after the $6.4 billion Binance hack
Quick Look
- North Korean hackers created at least six memecoins on the NEAR blockchain between Nov.
- 5 and 7 to launder roughly $430,000 stolen in the $6.4 billion Binance hack, according to Elliptic.
- The tokens attracted almost no outside trading and were abandoned shortly after launch.
AI-generated summary
Why It Matters
North Korean hackers created at least six tokens on the NEAR blockchain between Nov. 5 and 7 and used liquidity pools on decentralized exchanges to move stolen funds between wallets. The tokens attracted almost no outside trading and were abandoned shortly after launch. Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales just two to 13 minutes before the next launch.
North Korean hackers created memecoins to launder cryptocurrency stolen in the $6.4 billion Binance hack, routing roughly $430,000 through six newly launched tokens on the NEAR blockchain, according to a report from blockchain analytics firm Elliptic.
Between Nov. 5 and 7, the hackers created at least six tokens on NEAR and used liquidity pools on decentralized exchanges to move stolen funds between wallets, Elliptic said. The tokens attracted almost no outside trading and were abandoned shortly after launch.
The hackers used one set of wallets to swap stolen NEAR tokens for the new memecoins, then used another set to sell those memecoins back into the pools for NEAR. The swaps let them move funds without direct wallet-to-wallet transfers, though the transactions remained traceable onchain.
How stolen NEAR moved between wallets through liquidity pools. Source: Elliptic
Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales just two to 13 minutes before the next launch, linking the tokens in a chain of transactions.
"North Korea's launderers rarely rely on a single technique," Elliptic co-founder Tom Robinson wrote in the report. "Instead, they layer many cheap techniques, each adding a little more delay."
Elliptic said the same laundering technique was also used following the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain.
At the time of Elliptic's analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved. Elliptic valued those funds at $43.7 million.
What to Watch
AI outlook — possibilities, not facts
Blockchain analytics firms will continue tracking the unmoved 11.8 million NEAR tokens
Likely · Within weeks
Further investigations into North Korean-linked crypto laundering will be published
Possible · Within months
Open Questions
- Which specific wallets were used in the laundering chain?
- Has law enforcement taken any action against the token creators?
- What is the current status of the $43.7 million in unmoved stolen NEAR?
- Were any of the six memecoins traded on centralized exchanges?
