The short version
- North Korean hackers created at least six memecoins on NEAR between November 5 and 7 and pushed about 117,000 stolen Binance NEAR, around $430,000, through them, Elliptic says.
- Stolen NEAR goes into a pool the launderers control and comes out at fresh wallets, so the money looks like trading profit; each coin cost about $90 to launch.
- Next: about 11.8 million NEAR ($43.7 million) from the hack has not moved yet, and the same trick has shown up on Tron and Solana.
Ninety dollars. That is roughly what it costs to launch a memecoin on NEAR, and North Korean hackers have found a use for that price that has nothing to do with hype.
Blockchain analytics firm Elliptic said on Monday that the launderers behind the Binance hack, which it puts at $6.4 billion, created at least six of their own memecoins on NEAR between November 5 and 7. About 117,000 stolen NEAR, around $430,000, went through them. The goal is simple: make stolen coins look like trading profit.
Elliptic posted the find on X with its main warning for exchanges:
North Korea’s launderers are creating their own meme coins to move funds stolen from Binance.
Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went
How the North Korean Hackers’ Memecoin Trick Works
It is a swap loop with a fake coin in the middle. Elliptic describes four steps:
- The launderers create a token with one of NEAR’s public token-launch tools.
- They pair it with NEAR in a liquidity pool on a decentralized exchange, where anyone can swap one for the other.
- One set of wallets pays stolen NEAR into the pool and gets the new token back.
- A second set of wallets sells the token into the same pool and takes the NEAR out.
The pool sits in between, so no transfer links the two sides. The wallets that come out look like traders who sold a small coin at a profit.
The coins were dressed for the part, with logos like a monkey in a pink bow and Elon Musk under an “Elon 2028 President” banner. Elliptic says there is no suggestion Musk has anything to do with them. The tickers were FUK, OLCCL, MEILI, MMLI, DABI and SINU.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Why Build a Coin Nobody Buys?
To slow investigators down. Every swap is public on NEAR, so the trail can still be followed, but each extra hop takes time to untangle. Crypto laundering is a race to move funds before they get flagged.
Elliptic’s data shows these coins were never meant for anyone else. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. Outside buyers only showed up on FUK’s first day, with less than 1% of its volume. DABI, MMLI and SINU each had one buying wallet and one selling wallet.
The tokens also paid for each other. Five of the six creators were funded by a wallet that had been selling the previous token, between 2 and 13 minutes before the next launch. None of the six has traded since November 8, and that afternoon the creators of four of them pulled the liquidity left in their pools.
SIDE TRAIL: North Korea Binance FBI Row: Kim Yo Jong Calls Hack Probe a “Grave Provocation”
The Bybit Playbook, Now on Three Chains
For North Korean hackers this is not a new idea. Elliptic first spotted it after the 2025 Bybit hack, which, like the Binance theft, was blamed on North Korea’s TraderTraitor group. Back then the launderers created a worthless token on Tron, paired it with a stablecoin and moved at least $24 million through it.
The Binance launderers went back to it within days. On November 2 Elliptic found a token on Tron made only to launder funds. A day later, stolen SOL was swapped into wrapped and thinly traded tokens on Solana, then sold for USDC and moved to other chains. Those were existing tokens rather than home-made ones, but the job was the same: put an obscure asset between the stolen coins and the next wallet.
Elliptic co-founder Tom Robinson, who wrote the analysis, summed it up:
North Korea's launderers are passing crypto stolen from Binance through home-made memecoins, including one branded “Elon 2028 President”.
About $430k has been laundered in this way so far.
We traced it 👇
$430,000 is small next to the theft. But at $90 a coin, the trick can be repeated as often as the launderers like.
What It Means for NEAR Traders
Not much for the price so far. NEAR trades at $3.64 at the time of writing, up 4.5% in 24 hours but down 31% over 30 days. Laundering $430,000 is a rounding error next to $416 million of daily volume.
The real lesson is for anyone buying fresh tokens on a DEX. A coin that is days old, with a handful of wallets on each side and nobody else trading, is not a hidden gem. It might be someone else’s laundromat.
Elliptic tells exchanges to ask what went into a pool before they accept what came out of it. Its public Binance hack blocklist gets new wallets as they are found. Still waiting to move: 11.8 million stolen NEAR, about $43.7 million.
TRAIL MAP: Binance Hack: $6.3B Drained in the Biggest Crypto Theft Ever, Withdrawals Paused
Teddy has been trading crypto since 2016. The focus is altcoins and EMA setups: finding coins sitting on key levels, waiting for support to hold or a range to be reclaimed, and trading the move from there. Bitcoin sets the tone, but the opportunities are usually in the alts.
More from Teddy
