North Korean hackers behind last month’s record-setting $6.4 billion Binance heist are laundering stolen crypto assets through newly minted memecoins, according to a new analysis by crypto analytics firm Elliptic.
Memecoin Laundering on NEAR
Elliptic reports that the hackers used the NEAR blockchain to mint six new memecoins, each paired with NEAR tokens in its own liquidity pool. The tokens carry familiar-sounding names such as “FUK” and “SINU” and feature logos with chimpanzees, foxes, and Elon Musk under an “Elon 2028 President” banner.
The laundering process involved moving stolen NEAR into one set of wallets, which then paid into different liquidity pools and received the newly minted memecoins in return. A separate set of wallets sold the memecoins back into the liquidity pools and withdrew real crypto assets.
Tracing Slowed, Not Stopped
Tom Robinson, Elliptic’s chief scientist and co-founder, noted that the hackers’ moves remain trackable on blockchains.
“It does not hide the funds so much as slow down the people tracing them. Each extra hop takes time to unpick, and laundering is a race to move funds before they are flagged. The tokens are also cheap, at about $90 each on NEAR, so the launderers can make many of them and discard each one after use,” Robinson said.
“North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay. Home-made meme tokens are simply one more layer.”
Similar Tactics on Tron and Solana
The hackers also used the same technique on the Tron (TRX) blockchain and a similar approach on Solana (SOL) with preexisting but thinly traded tokens, according to Elliptic.
Chainalysis attributes the record-setting hack to the North Korean cybercrime group TraderTraitor, which is believed to operate under the umbrella of the state-sponsored hacking outfit known as the Lazarus Group.
