North Korean hackers have used a set of meme coins to launder a portion of the funds stolen in the $6.4 billion Binance hack, according to blockchain analytics firm Elliptic. One of the tokens featured an image of Elon Musk under an “Elon 2028 President” banner, Elliptic said Monday.
How the Laundering Worked
Elliptic estimated that about 117,000 NEAR Protocol (NEAR) tokens, worth roughly $430,000 at the time, passed through six homemade meme coins. Each token cost about $90 to launch. The launderers paired every token with NEAR in a liquidity pool on a decentralized exchange.
The scheme involved two groups of wallets: one bought the token with stolen NEAR, and a second sold it back, walking away with NEAR. On the blockchain, the sellers appeared to be lucky traders rather than direct transfers from thief to receiver.
The tokens carried American-themed imagery. One logo showed a duck before a US flag, and another carried the Musk banner. Elliptic did not specify which of the six tokens carried the Musk image. The firm also said Musk has no link to the tokens.
Limited Trading, Quick Lifespan
Almost no outsiders traded the coins; external buyers purchased less than 1% of one token’s trading volume. Each coin traded heavily within hours and then became inactive. Profits from one token funded the next, according to Elliptic.
“It does not hide the funds so much as slow down the people tracing them,” Elliptic quoted Tom Robinson as saying in its blog post.
Elliptic noted that launderers must cash out before their wallets are added to blocklists. The same technique was used to move at least $24 million after the 2025 Bybit hack.
Most Stolen NEAR Remains Unmoved
About 11.8 million stolen NEAR, worth approximately $43.7 million by Elliptic’s estimate, has not yet moved. The meme coin route has handled less than 1% of that total so far.
Elliptic stressed that the launch tool, the exchange, and the wallet app did nothing wrong; the launderers used them like any other customer. The firm said the burden falls on receivers of the funds and that exchanges should re-examine deposits they have already cleared as its blocklist grows.
