North Korea-Linked Launderers Utilize Memecoins to Move Stolen Funds from Binance Hack

North Korea-Linked Launderers Use Memecoins to Move $430,000 from Binance Hack

In a sophisticated scheme that highlights the evolving tactics of cryptocurrency criminals, North Korea-linked launderers have reportedly created throwaway memecoins to facilitate the movement of approximately $430,000 from the notorious $6.4 billion Binance hack. According to a report by blockchain analytics firm Elliptic, the operators minted six NEAR tokens between November 5 and 7, using them to route stolen funds through decentralized exchange pools.

The Mechanics of the Laundering Operation

The six tokens—FUK, OLCCL, MEILI, MMLI, DABI, and SINU—were each created at a cost of around 25 NEAR, or approximately $90. Once minted, the launderers paired these tokens with NEAR in separate trading pools, effectively disguising the illicit transactions. Elliptic’s analysis reveals that around 117,000 stolen NEAR were funneled through these pools, with similar activities observed on the Tron blockchain and existing thinly traded tokens on Solana.

In a clever twist, one group of wallets purchased the tokens using stolen cryptocurrency, while another group sold them back into the same pool, allowing them to collect legitimate assets without direct transfers. This method creates the illusion of normal trading activity, complicating efforts by compliance teams to trace the origins of the funds.

The Scale of the Operation

Elliptic’s investigation has tracked the laundering across more than 20,000 wallets spanning 16 different blockchains. The firm’s laundering tracker, updated on November 9, indicates that the operation has involved at least 36 services and 65,000 transactions. Notably, since November 8, wallets associated with the theft have deposited approximately 7,000 ETH—valued at around $15 million—into Tornado Cash, a service known for its privacy features.

The report further reveals that around $3 billion remains in theft-linked addresses, while $2.85 billion has been frozen. Elliptic estimates that only a negligible amount of the stolen funds has been cashed out, indicating a concerted effort to obfuscate the trail.

Binance’s Response to the Breach

The Binance hack, attributed to a group known as TraderTraitor, was traced back to a months-long intrusion involving compromised employee computers. The exchange detailed a series of events that led to the breach, including fake recruitment interviews and the use of malicious code disguised as legitimate development tools. Binance has since set aside more than the full amount of the theft to cover losses.

In a separate effort to recover frozen assets, Binance has proposed a governance vote to return approximately 8,425 ETH and 74.56 million ARB immobilized on the Arbitrum network. The recovery process is expected to take at least seven weeks, involving discussions and votes among the network’s Security Council.

Conclusion

As the cryptocurrency landscape continues to evolve, so too do the methods employed by criminals. The use of memecoins and decentralized exchange pools to launder stolen funds underscores the challenges facing regulators and compliance teams in tracking illicit activities. With billions still at stake, the race between law enforcement and cybercriminals shows no signs of slowing down.