North Korean launderers have turned to disposable meme coins to disguise proceeds from the roughly $6.3 billion Binance hack, according to Elliptic. The blockchain analytics firm identified related tactics on three blockchains, adding cheap, repeatable obstacles to efforts to trace the stolen assets.
Meme Coins Complicate the Trail
Elliptic co-founder and chief scientist Tom Robinson explained on Nov. 9 that launderers used meme coins and obscure tokens on Tron, Solana, and Near. Tron and Near involved newly created coins, while Solana relied on existing assets.
“Most people think of meme tokens as joke coins whose prices rise and fall on hype. North Korea’s launderers have found a different use for them, creating tokens that nobody else wants to buy and using them to disguise the movement of stolen funds,” Robinson wrote.
On Near, one group bought the new coins with stolen cryptocurrency through token liquidity pools. Other wallets sold into the same pools and collected nearly matching proceeds, separating the sending and receiving addresses.
Six tokens created between Nov. 5 and Nov. 7 handled about 117,000 NEAR ($430,000), with almost no outside trading. Each launch cost about $90. Five creators received funding from earlier token sales shortly before launching replacements.
The FBI attributed last month’s Binance theft to North Korea on Oct. 31, identifying the operation as Tradertraitor, a state-sponsored North Korean group targeting cryptocurrency businesses. However, North Korea denied responsibility for the hack on Nov. 3. Kim Yo-jong, sister of North Korean leader Kim Jong Un, called the FBI’s accusations a “grave political provocation” intended to damage the country’s reputation.
Binance Theft Triggered a Race Against Freezes
Stolen assets from the Oct. 29 Binance attack mixed with proceeds from September’s Bitget theft, Chainalysis found. The firm cited this overlap in attributing the Binance theft to Tradertraitor, based on blockchain activity observed in the hours after the attack.
The attacker attempted to evade freezes through rapid stablecoin conversions, exchanging $325 million in funds for approximately $285 million in ether over nearly 20 minutes. Ether lacks the issuer-controlled freezes available for those stablecoins.
Elliptic flagged a worthless Tron token created solely for laundering on Nov. 2, and stolen solana moved through thinly traded tokens the next day. Elliptic previously traced at least $24 million through a similar scheme after the 2025 Bybit theft.
“North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay. Homemade meme tokens are simply one more layer,” Robinson stated.
Thousands of Wallets Lead Into Bitcoin
By Nov. 2, stolen assets had passed through approximately 12,000 wallets across 11 blockchains. Fixed timing and blind retries of failed operations without adjustment indicated conventional automation. Elliptic found no evidence of AI-directed decisions.
A Nov. 7 update counted more than 20,000 wallets, 16 blockchains, and at least 65,000 transactions. Elliptic tracked conversions into approximately 2,300 bitcoin, worth $175 million then, from assets including solana, XRP, and tron.
Converted proceeds reached about 3,000 bitcoin, worth $225 million by Nov. 9. Elliptic also traced roughly 7,000 ether (about $15 million worth) into Tornado Cash, a mixer allowing pooled deposits to be withdrawn to different addresses. The firm estimated that only a negligible amount had likely been cashed out.
On exposure through trading pools, Robinson warned: “A wallet that received its funds from a liquidity pool should not be treated as clean by default, as it may sit just two swaps away from stolen funds.”
