North Korean Hackers Use Memecoins to Launder NEAR

What to Know

North Korean hackers used six homemade memecoins to launder 117,000 NEAR, worth about $430,000, from the $6.3 billion Binance hack, Elliptic says.
The tokens were created between Nov. 5 and Nov. 7 and paired with NEAR in separate liquidity pools on a decentralized exchange.
One set of wallets bought the memecoins with stolen NEAR, while another set sold the same tokens back for NEAR, making the movement resemble trading profits.
Elliptic says almost all trading activity came from wallets tied to the laundering scheme, with outside buyers accounting for less than 1% of one token's volume.
Trading across all six tokens stopped by Nov. 8.
The FBI has pointed to North Korea's TraderTraitor group as responsible for the Oct. 29 Binance theft.
The hackers have also used THORChain to convert stolen assets into bitcoin, which cannot be frozen by a central issuer.
Elliptic identified a similar memecoin laundering method after the 2025 Bybit hack.

Homemade Memecoins Become a Laundering Tool

North Korean hackers used six self-created memecoins to launder 117,000 NEAR, worth about $430,000, from the $6.3 billion Binance hack, according to blockchain analytics firm Elliptic. The activity shows how attackers are experimenting with the culture and mechanics of decentralized markets to disguise stolen crypto as ordinary trading gains, while still leaving a public trail that investigators can follow across wallets, liquidity pools, and token contracts.

The tokens were created between Nov. 5 and Nov. 7, shortly after the Oct. 29 Binance theft that the FBI has linked to North Korea's TraderTraitor group. Rather than moving funds directly from one wallet to another, the hackers created new tokens, paired each one with NEAR on a decentralized exchange, and generated trading activity between wallets that Elliptic says were tied to the laundering operation.

The apparent objective was to turn stolen NEAR into what looked like market profit. One group of wallets used the stolen NEAR to buy the new memecoins, while another group of wallets sold those memecoins back into NEAR. Because the funds did not simply pass in a straight line from one wallet to another, the activity could appear, at a surface level, to reflect successful speculative trading instead of proceeds from a hack.

How the NEAR Laundering Pattern Worked

The method relied on a familiar decentralized finance structure: liquidity pools. In a liquidity pool, two assets are paired so traders can swap between them without relying on a traditional order book. In this case, each of the six homemade memecoins was paired with NEAR in its own pool, giving the hackers a venue to manufacture volume and move value through token swaps.

Elliptic co-founder and chief scientist Tom Robinson said the launderers made six crypto tokens and traded them only with themselves, causing the stolen funds to look like trading proceeds. That characterization is important because it underlines the difference between actual market demand and staged activity. The wallets were not participating in a broad market for popular tokens; they were using self-made assets to create the appearance of market activity around funds traced to the Binance hack.

Elliptic found that almost all trading came from wallets connected to the laundering scheme. Outside participation was minimal, with external buyers accounting for less than 1% of one token's volume. That limited outside activity suggests the tokens were not primarily created to attract a real community of traders, but to serve a laundering purpose inside a controlled trading environment.

Trading across all six tokens stopped by Nov. 8, according to Elliptic. The short-lived nature of the activity fits a pattern often seen in illicit crypto movements, where attackers create temporary pathways to move funds before abandoning the structure and shifting to other channels. In this case, the use of memecoins added an additional layer of noise, but not enough to remove the onchain trail.

Memecoin Culture Provides Cover, but Not Anonymity

The choice of memecoins was not accidental. Memecoins often launch quickly, trade on hype, and use attention-grabbing imagery or jokes to draw interest. One of the six tokens featured an image of Elon Musk under an “Elon 2028 President” banner, though Elliptic said there is no suggestion that Musk is connected to the tokens. The token names also followed familiar memecoin conventions, including a crude joke and the “inu” suffix associated with dog-themed crypto assets.

That style matters because memecoin markets can appear chaotic even when they are legitimate. New tokens may see sudden bursts of trading, sharp price moves, thin liquidity, and limited information about their creators. Those characteristics can provide practical cover for suspicious movement because unusual trading behavior is common in the sector. However, the same transparency that allows anyone to inspect token contracts and wallet activity also gives blockchain analytics firms a way to reconstruct the flow of funds.

In this case, the structure did not erase the history of the stolen assets. Elliptic said the method complicates efforts to trace the funds but does not make the trail disappear. On public blockchains, token swaps, liquidity pool interactions, wallet links, and timing patterns can be examined even when the activity is designed to look like ordinary trading.

North Korea's Crypto Operations Keep Evolving

The FBI has pointed to North Korea's TraderTraitor group as responsible for the Oct. 29 Binance theft. North Korean hacking groups have long been associated with attempts to steal, move, and convert digital assets, often seeking assets or venues that are difficult to freeze or reverse. The use of homemade memecoins adds another technique to a growing set of laundering methods used after major exchange and platform breaches.

The hackers have also used THORChain to convert stolen assets into bitcoin, according to Elliptic. Bitcoin cannot be frozen by a central issuer, which can make it attractive to attackers attempting to avoid asset freezes that may apply to tokens controlled by centralized issuers. The combination of decentralized exchange infrastructure, cross-chain tools, and liquid crypto assets gives illicit actors multiple options as they try to move funds away from the original theft.

Still, this case also shows the limits of laundering on transparent networks. Even when assets are moved through custom tokens and multiple wallets, investigators can look at the timing, funding sources, trading relationships, and destination wallets. The movement may become more complicated, but complexity is not the same as invisibility.

Why the Binance Hack Remains Under Scrutiny

The $6.3 billion Binance hack remains a major focus for investigators, analytics firms, exchanges, and market participants because of its scale and the sophistication of the laundering that followed. When stolen funds move across decentralized infrastructure, the response becomes broader than any one platform. Analytics providers trace flows, exchanges monitor deposits, decentralized protocols face renewed attention, and law enforcement agencies assess attribution and recovery options.

The use of 117,000 NEAR in the memecoin laundering scheme represents only a portion of the wider case, but it is significant because it demonstrates a creative way to manufacture apparently legitimate gains. Instead of simply swapping stolen assets for another coin, the hackers created the market venue, supplied the trading instrument, and controlled much of the activity around it.

For crypto markets, the incident is a reminder that liquidity and openness are double-edged features. Permissionless token creation allows developers and communities to experiment rapidly, but it also lets attackers create disposable assets for obfuscation. Decentralized trading can reduce reliance on intermediaries, but it also makes it easier for bad actors to transact without first passing through traditional compliance gates.

Onchain Visibility Remains a Key Defense

Blockchain analytics firms are increasingly important in major crypto crime investigations because public ledgers preserve transaction histories. Elliptic identified a similar memecoin laundering method after the 2025 Bybit hack, suggesting that the tactic is not isolated. Once a laundering method proves useful, it may be repeated, adapted, or combined with other tools by sophisticated attackers.

For exchanges and trading venues, the findings may reinforce the need to monitor not only direct deposits from known illicit wallets but also funds that arrive after passing through short-lived tokens, liquidity pools, or cross-chain systems. For users, the case underscores the risks of interacting with newly created tokens that have little organic trading activity and unclear origins. Even small amounts of outside activity can occur around tokens built primarily for laundering, especially in speculative memecoin markets where traders may chase sudden volume without understanding its source.

The central takeaway is that the laundering technique created friction for investigators but did not eliminate the evidence. Six homemade tokens, staged NEAR trades, and controlled liquidity pools may have changed the appearance of the funds, but Elliptic says the path remained visible onchain. That distinction is crucial as digital asset markets continue to balance open participation with the need to detect and disrupt illicit finance.

Frequently Asked Questions (FAQs)

What did North Korean hackers do with the memecoins?

They used six homemade memecoins to launder 117,000 NEAR, worth about $430,000, tied to the $6.3 billion Binance hack, according to Elliptic.

How did the laundering scheme work?

The hackers paired each memecoin with NEAR in a decentralized exchange liquidity pool, then used one set of wallets to buy the tokens with stolen NEAR and another set to sell them back for NEAR.

Why use memecoins for laundering?

Memecoins can be created quickly and often trade in chaotic markets, which can help suspicious activity resemble speculative trading. In this case, Elliptic says the trading was largely controlled by wallets tied to the laundering scheme.

How much outside trading activity occurred?

Elliptic found that almost all trading came from wallets linked to the laundering operation, with outside buyers accounting for less than 1% of one token's volume.

When were the tokens created?

The six memecoins were created between Nov. 5 and Nov. 7, and trading across all six tokens stopped by Nov. 8.

Who has been linked to the Binance hack?

The FBI has pointed to North Korea's TraderTraitor group as responsible for the Oct. 29 Binance theft.

Did the memecoin method erase the transaction trail?

No. Elliptic says the technique complicates tracing efforts but does not erase the trail, because the activity remains visible onchain.

Were any public figures connected to the tokens?

One token used an image of Elon Musk under an “Elon 2028 President” banner, but Elliptic said there is no suggestion that Musk is connected to the tokens.