North Korean Hackers Use Meme Coins to Launder Binance Hack Funds

North Korean hackers are leveraging the popularity of joke tokens to shuffle stolen assets, marking a new phase in the aftermath of the record $6.4 billion Binance hack. According to a report by blockchain analytics firm Elliptic, the perpetrators are minting their own worthless meme coins to break the direct on-chain link between their illicit wallets and the final destination of the stolen cryptocurrency. This tactic is part of the ongoing effort to move funds following the massive Binance hack news.

The mechanics of the meme coin scheme

The laundering process involves creating a new, valueless token and pairing it with a legitimate asset like Near or a stablecoin within a decentralized liquidity pool. The hackers then use one set of wallets to purchase these tokens with stolen funds, subsequently selling them through a different set of wallets to withdraw assets that appear clean. By using the liquidity pool as an intermediary, the direct link between the origin and the final wallet is severed, making the receiving addresses appear as ordinary traders cashing out.

Elliptic, in research led by co-founder Tom Robinson, identified that this strategy was deployed on the Tron and Near networks, with a similar variant observed on Solana. Between November 5 and 7, the actors created at least six tokens on the Near network. These coins featured common meme-coin imagery, including cartoon monkeys, ducks, chimpanzees, and a fox. One token even utilized an image of Elon Musk labeled "Elon 2028 President," despite the entrepreneur having no connection to the project. The tokens, which cost approximately $90 each to create, were traded heavily using stolen funds before the liquidity was removed on November 8.

Hackers are using worthless meme coins to shuffle stolen crypto and obscure the trail of illicit funds.

Approximately $430,000 worth of Near was processed through these six tokens. While these sums represent only a small fraction of the total stolen, the maneuver highlights the persistent efforts of the TraderTraitor group to move capital at machine speed. Elliptic noted that the hackers frequently spin up new wallets every 25 seconds to facilitate these transfers.

Why it matters

While this laundering technique complicates the work of investigators, Elliptic emphasizes that the trail remains fully traceable on-chain. The tactic is primarily designed to slow down tracking efforts, buying the hackers time to move funds before they are flagged.

For compliance teams and financial institutions, this development serves as a warning that funds originating from liquidity pools should not automatically be considered clean. The use of freshly minted tokens and high-frequency trading wallets requires increased vigilance to prevent the integration of stolen assets into the broader financial system.