vibecodai

Security

North Korea-Linked Launderers Mint Throwaway Memecoins to Slow Binance Hack Tracing

Updated

  • Consumer Security
  • Breaches
  • Explainer
North Korea-Linked Launderers Mint Throwaway Memecoins to Slow Binance Hack Tracing
Uploaded by the desk

The launderers moving funds from the record Binance theft have started making their own memecoins, trading them only with themselves and throwing them away within hours. Blockchain analytics firm Elliptic says the trick slows investigators down without hiding where the money goes. Two things explain why it exists: how cheap a token is to create, and how much of the loot was frozen early.

In a report published November 9, Elliptic said the people laundering the $6.4 billion stolen from Binance on October 29 created at least six "home-made" tokens on the NEAR blockchain between November 5 and November 7 (UTC dates). About 117,000 NEAR, roughly $430,000 at current prices according to Elliptic, passed through them. Each token cost about 25 NEAR, around $90, to create. All six stopped trading by November 8.

In money terms this is tiny, about 0.007% of the theft. It still matters, because it shows how a state-linked laundering operation adapts when the easy routes close. It also shows how little separates a "trading profit" from stolen funds on a public blockchain.

What is established about the Binance theft

The theft itself is well documented. Elliptic's figure is $6.43 billion, taken from Binance hot wallets across 11 blockchains. Outflows began at about 4:05 p.m. New York time (EDT) on October 29, and the last unauthorized transfer finalized at 7:56 p.m. New York time (EDT). Binance's first estimate was "around $6.3B". Its initial findings report of November 3 puts the figure at "approximately USD 6.34 billion". Chainalysis puts it at about $6.4 billion. The gap most likely reflects valuation timing and which transfers each party counts. Elliptic, for example, values assets at the time of theft and excludes a further $169 million that it believes was Binance moving its own funds. Every estimate makes it the largest crypto theft on record. The previous record was the $1.46 billion taken from Bybit in February 2025, which Elliptic says was itself more than twice the size of any earlier crypto theft.

On October 31, the FBI attributed the theft to North Korea, naming the activity "TraderTraitor," the same designation it gave the Bybit theft. Chainalysis and TRM Labs had reached the same conclusion. Chainalysis says its strongest evidence was stolen Binance funds mixing on-chain with proceeds of a September exploit of Bitget that had been attributed to North Korea. Binance's own report cites the FBI's attribution. It describes a months-long campaign that included a tampered developer-tool installer in June, fake job interviews with an engineer in September and abuse of an internal AI tool in October. North Korea has denied involvement. The Record reported that Kim Yo Jong called the accusation an "absurd" attempt to "damage the international image of the DPRK."

One distinction matters for this story. The FBI attributed the theft. Elliptic's memecoin report concerns the laundering, which it describes as the work of "North Korea's launderers." In its running laundering tracker, Elliptic adds a caveat: "When we say 'the attacker,' we mean whoever controls the wallets now holding the funds." It says funds still being laundered "may already be with Chinese money laundering networks, which North Korea has used before." The tokens were launched with stolen funds by the laundering network. Whether North Korean operators or hired intermediaries pressed the buttons, the on-chain data cannot say.

How the home-made token trick works

Elliptic describes the technique at a high level. The launderers create a new token with a public token-launch tool. They pair it with a real asset in a liquidity pool on a decentralized exchange, an automated market where anyone can swap one asset for another. One set of wallets pays stolen funds into the pool and receives the new token. A second set sells the token back into the same pool and withdraws the real asset.

"At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between," Elliptic wrote. "To a casual observer, the collecting wallets look like ordinary traders who have sold a token at a profit."

The pool works as a container. Because nobody else trades the token, its price is whatever the launderers make it. The memecoin dressing provides cover, since thousands of novelty tokens launch every day and most die within days. The six NEAR tokens were named FUK, OLCCL, MEILI, MMLI, DABI and SINU, and their logos included a monkey in a pink bow, a duck in front of a US flag and an image of Elon Musk under an "Elon 2028 President" banner. Elliptic says "there is no suggestion that he has any connection to the tokens."

According to Elliptic, the first token, FUK, was created at 7:25 p.m. New York time (EST) on November 4 (00:25 UTC on November 5). Four more followed between 2:19 a.m. and 9:27 a.m. New York time (EST) on November 6, and the last, SINU, was created at 5:06 a.m. New York time (EST) on November 7.

Why Elliptic is confident the tokens were made to launder

The firm points to three patterns in the trading data:

  • Nobody else traded them. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. The only outside activity was a few small purchases of FUK on its first day, under 1% of its volume. Three tokens had a single buying wallet and a single selling wallet.
  • Each token was paid for with laundering proceeds. Five of the six token creators were funded by a wallet that had been selling an earlier token, between two and 13 minutes before the new launch. Elliptic says "the tokens form a chain, with the proceeds of one paying for the next."
  • The tokens were used once and dropped. Each was first sold within three hours of launch, did at least three-quarters of its trading within a day, and in every case the stolen NEAR going in matched the NEAR coming out.

The buying wallets were funded from the main stolen-NEAR wallet through intermediate accounts. Almost exactly the same amount left the collecting wallets soon afterwards, much of it into stablecoins or to a cross-chain bridge. Elliptic does not name the launch tool, exchange or wallet app involved, and says they "did nothing wrong; the launderers simply used them as any other user could."

The economics: a cheap speed bump

Elliptic's numbers allow a simple cost estimate. This is VibeCodAI's calculation, not Elliptic's. Six tokens at about 25 NEAR each comes to roughly 150 NEAR, or about $540, to create the containers for about $430,000. That is about 0.13% of the amount moved. The figure leaves out network and swap fees, which Elliptic does not report. Even so, it shows why the firm calls each token "cheap enough to throw away."

The $430,000 is also small next to what has not moved. Elliptic says about 11.8 million NEAR, worth $43.7 million, from the theft is still untouched. The memecoin run was therefore equal to about 1% of the stolen NEAR still waiting to be laundered. Against the whole theft it is about 0.007%.

That is why Elliptic frames the technique as a delay tactic, not a vanishing act. "Every step of this technique is recorded publicly on the blockchain, and investigators can follow it," it wrote. "It does not hide the funds so much as slow down the people tracing them." Laundering is a race to move money before addresses are flagged, and "North Korea's launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay." Elliptic's tracker lists the other layers. Since the theft, the laundering has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. Those include cross-chain bridges, lending-vault hops, bitcoin coinjoins and, from November 8, Tornado Cash.

Why freezes push launderers toward assets like NEAR

The broader context is the most unusual feature of this theft: how much of it was frozen. About $3.46 billion of the stolen funds were stablecoins. Their issuers can freeze tokens at specific addresses. Elliptic says Tether froze the attacker's main Ethereum wallet 37 minutes after the stolen USDT arrived, and Circle froze all 823 million stolen USDC before any of it was swapped. Elliptic has verified $2.85 billion frozen or seized, about 44% of the theft. After Bybit, around 3% was frozen.

Native blockchain assets work differently. Elliptic says nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, "because native assets have no issuer that can freeze them." There are exceptions at the edges. Elliptic says Arbitrum's Security Council and Optimism's governance moved stolen assets out of the attacker's reach on those networks, and centralized exchanges can still freeze funds when they arrive for cash-out. But no issuer can freeze bitcoin, ether or NEAR at an address.

So the attacker's first move was to swap stablecoins for assets like ETH and TRX before the freezes landed. Elliptic says about $786 million was converted that way. Once most of the remaining money sat in assets no issuer can freeze, Elliptic notes, "there is no rush" to dump them. The race that remains is against analysts flagging addresses, so the incentive shifts to making each hop slower to unpick before the funds reach a service that can stop them. Throwaway memecoins fit that phase of the laundering.

Not new, and not quite the same everywhere

Elliptic says the idea is not new. In an August 2025 analysis of the Bybit laundering, it described "a novel way to obfuscate the movement of at least $24M of stolen funds" on Tron. A worthless token was paired with jUSDT, a Tron DeFi token, in a pool on the SunSwap exchange. Stolen USDT was swapped into the token, and fresh addresses later swapped tokens they had received back out of the pool. The firm also noted that "similar methods have been observed in previous DPRK theft laundering."

The Bybit version was not identical to what happened on NEAR. In Bybit, the pool was paired with a stablecoin-linked token, and the cash-out wallets received the token from the creator's address rather than buying it themselves. The Binance launderers "turned to the same idea within days of the theft," Elliptic says. On November 2 the firm identified a token on Tron created solely to launder funds, "similar to those used in the Bybit case." Solana saw a variant. There, stolen SOL was swapped into "wrapped and thinly traded tokens" that already existed, "rather than home-made ones, but the aim was the same."

The Bybit precedent is also a reminder of scale. That operation moved at least $24 million through a single worthless token, roughly 56 times the NEAR total so far. Elliptic warns that the technique "is cheap to run and could carry far larger sums."

Who should care

For exchanges and other businesses that screen incoming crypto, Elliptic's advice is direct: "A wallet that received its funds from a liquidity pool should not be treated as clean by default, as it may sit just two swaps away from stolen funds." It lists warning signs, including a token created in the last few days, a pool with only a handful of traders, some wallets that only buy while others only sell, and new wallets funded shortly before trading. Elliptic and the FBI have both published lists of addresses linked to the theft.

For ordinary memecoin traders, the lesson is narrower but real. A new token with a cartoon logo and sudden volume is not proof of demand. In this case almost all of the volume came from one operation trading with itself. The handful of outside purchases of FUK went into a market that existed only to move stolen funds. All six tokens stopped trading by November 8, and Elliptic says the creators of four of them withdrew the remaining pool liquidity that afternoon.

What to watch

The bigger test is still ahead. Elliptic estimates that around $3.0 billion remains in addresses linked to the theft, mostly ETH and bitcoin, and that "a negligible amount has likely been cashed out so far." The attacker's main ETH and bitcoin holdings had not moved as of its latest update, at 8:15 a.m. New York time (EST) on November 9. Elliptic expects the ETH to be swapped into bitcoin in small transactions and cashed out through over-the-counter brokers over months, as happened after Bybit.

Throwaway tokens are a small part of that process. They show the method more than the scale: cheap, disposable layers that make the trail slower to follow. Each layer still leaves a record. Whether the money is stopped will depend less on any single trick than on how quickly exchanges and brokers act when flagged funds reach them.

Sources

← Back to vibecodai homepage