Elliptic says North Korean hackers used six NEAR memecoins to launder Binance loot
Elliptic says hackers tied to North Korea minted six memecoins on NEAR to move part of the Binance hack proceeds through DEX liquidity pools.
Blockchain analytics firm Elliptic says hackers behind the Binance theft are minting their own memecoins to obscure where stolen money goes. According to CoinDesk, Wu Blockchain and BeInCrypto, all citing Elliptic, the attackers created six tokens on the NEAR network and ran about 117,000 NEAR, roughly $430,000 by Elliptic's estimate, through them.
Outlets disagree on the size of the original theft. CoinDesk calls it a $6.3 billion hack, Wu Blockchain, BeInCrypto and U.Today say $6.4 billion, and Watcher.Guru says $6 billion. BeInCrypto reports that the FBI blamed North Korea for the October theft.
How the laundering works
Wu Blockchain, relaying Elliptic's report, says the tokens were created between November 5 and 7 and cost about $90 each to launch. BeInCrypto adds that each token was paired with NEAR in a liquidity pool, which is an automated swap venue on a decentralized exchange.
In BeInCrypto's description of Elliptic's diagram, one group of wallets bought a token using stolen NEAR, and a second group sold it back and received NEAR. The funds never went directly from sender to recipient, and the sellers appeared on-chain as ordinary traders who had made a profit.
The tokens used American-themed imagery, according to BeInCrypto and The Block. One logo showed a duck in front of a US flag, and another showed Elon Musk under an "Elon 2028 President" banner. BeInCrypto says Elliptic stated that Musk has no connection to the tokens.
What it means for investigators and exchanges
The Block reports that Elliptic says the added swaps slow investigators down, but the stolen funds can still be traced on-chain. That means the technique adds work rather than making the money untraceable, based on the firm's assessment as reported.
Wu Blockchain says Elliptic previously saw a similar method used to launder money from the 2025 Bybit hack. BeInCrypto reports that Elliptic wants exchanges that have already accepted funds from these trades to review them again.
The amount moved this way is small next to the total stolen. The sources do not say how much of the stolen funds has been laundered overall, or whether any have been frozen or recovered.
Open questions
None of the sources lists a scheduled deadline or official action tied to this finding. What remains unresolved is whether exchanges re-screen the deposits Elliptic flagged, and whether the attackers use more tokens or other chains. The sources also leave unanswered whether authorities have taken further steps beyond the FBI's attribution reported by BeInCrypto.
Sources
- North Korean hackers are creating memecoins to wash loot from $6.3 billion Binance hack CoinDesk
- Elliptic: North Korean Hackers Create Meme Tokens on NEAR to Launder Binance Hack Funds Wu Blockchain
- Binance hack launderers mint homemade Elon Musk, animal memecoins to move stolen funds: Elliptic The Block
- Binance Hack Update: North Korea Used Elon Musk’s Face to Launder Money BeInCrypto
- North Korean hackers are using memecoins to launder funds stolen from the $6 billion Binance crypto hack Watcher.Guru
- North Korean Hackers Flip Stolen Binance Funds Into NEAR Meme Coins U.Today
Written with AI assistance from the sources above and checked against them. Not investment advice.