Elliptic: North Korean hackers use memecoins to launder Binance hack funds

North Korean-linked hackers reportedly used newly created memecoins on the NEAR blockchain to launder funds stolen in Binance’s high-profile incident, according to a report by blockchain analytics firm Elliptic.

Elliptic said the scheme involved creating at least six tokens between Nov. 5 and 7 and routing roughly $430,000 through them—tokens that drew little outside trading and were abandoned shortly after launch. The laundering method relied on decentralized exchange liquidity pools to shuffle value while keeping the activity difficult to spot as direct wallet-to-wallet transfers.

Key takeaways

• Elliptic attributes a NEAR memecoin laundering chain to North Korea-linked actors following the $6.3 billion Binance hack.
• Between Nov. 5 and 7, the group created at least six NEAR tokens and used DEX liquidity pools to move about $430,000.
• Most of the tokens saw minimal external trading before being abandoned, suggesting they were used primarily as transfer vehicles.
• Elliptic observed rapid funding and deployment activity among token creators, linking launches into a chain of transactions.
• The same general laundering approach has previously appeared after other major hacks, including the 2025 Bybit incident on TRON.

Memecoins as a laundering layer on NEAR

Elliptic’s analysis describes how stolen NEAR tokens were converted and redistributed through a multi-step process. The report says the hackers used one set of wallets to swap compromised NEAR holdings into newly launched memecoins, then used a separate set of wallets to sell those memecoins back into DEX liquidity pools for NEAR.

This structure can complicate simple attribution because the movement of value does not rely solely on direct wallet-to-wallet transfers. Even so, Elliptic emphasizes that the transactions remain traceable onchain, allowing analysts to connect the steps into a coherent laundering workflow.

Rapid token launches and weak public liquidity signals

In Elliptic’s account, the tokens themselves were designed for speed and function rather than organic market adoption. The six newly created tokens attracted almost no outside trading activity, and—crucially—were abandoned shortly after launch.

Elliptic also found that five of the six token creators appeared to be funded using proceeds from earlier token sales, with funding occurring just two to 13 minutes before each subsequent launch. That tight timing supports the idea that the memecoins were deployed as components in a staged sequence rather than separate, unrelated attempts.

“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”

How this compares with earlier North Korea laundering patterns

Elliptic noted that the laundering technique used on NEAR mirrors activity it previously observed after the $1.5 billion Bybit hack in 2025. In that earlier case, Elliptic reported that North Korean-linked actors moved at least $24 million through a token newly created on the TRON blockchain.

While the chains differed by network and token design, the throughline is consistent: value is routed through quick-launch assets and decentralized exchange mechanics to create friction for investigators. The contrast that matters for readers is not only that the actors reused a pattern, but that the approach can scale across different ecosystems—suggesting the laundering “playbook” is adaptable rather than fixed to one platform.

What remains of the stolen Binance funds

Elliptic’s assessment at the time of its analysis found that about 11.8 million NEAR stolen in the Binance hack remained unmoved. The firm valued that portion at $43.7 million.

That figure underscores why investigators and market participants continue to monitor onchain activity even after initial thefts. If laundering attempts can be executed quickly with minimal public interaction—using memecoins and DEX pools—then the remaining balance could be targeted again with additional hops, conversions, or staged sales, depending on how the attackers manage liquidity and timing.

Why investors and users should pay attention

Even though the activity described by Elliptic appears to have involved little genuine trading, the broader implication is that token ecosystems remain vulnerable to being used as covert transfer rails. For investors, this highlights why provenance and traceability matter beyond “hack headlines”—the laundering phase can involve small, short-lived tokens meant to blend into blockchain activity. For builders and platforms, it reinforces the need for robust monitoring that accounts for rapid token creation, interconnected creator wallets, and liquidity-pool-driven conversion paths.

For now, the key question is whether the remaining $43.7 million (as Elliptic valued the unmoved NEAR) will be targeted next—and whether investigators will see similar token-launch chains on other networks. Elliptic’s findings suggest attackers may keep layering tactics, so monitoring should extend beyond direct exchange withdrawals to the downstream movements that occur through decentralized markets.