North Korean Hackers Create Fake Meme Coins to Launder Stolen Funds From $6.4 Billion Binance Hack

North Korean hackers are creating disposable meme coins to move cryptocurrency stolen in the $6.4 billion Binance hack, using fake trading activity to make criminal proceeds resemble ordinary investment returns.

The operation places decentralized exchange liquidity pools between wallets holding stolen assets and wallets collecting the proceeds, complicating efforts to trace and freeze the money.

The laundering follows the October 29, 2026, theft attributed to TraderTraitor, a North Korean hacking group. Earlier reporting on the FBI’s North Korean attribution connected the Binance attack to an operation previously blamed for major cryptocurrency thefts.

Elliptic’s latest findings show how the operators are moving part of those stolen funds after the initial breach.

Researchers from Elliptic identified the meme coin laundering activity in a November 9 investigation led by co-founder Dr. Tom Robinson.

Their report examines blockchain transactions rather than identifying a new malware family. It documents related techniques on Tron, NEAR, and Solana, with approximately 117,000 NEAR, worth around $430,000, passing through six newly created tokens.

North Korean Hackers Create Fake Meme Coins

The process starts with attackers creating a token through a public launch tool. They then establish a liquidity pool pairing that token with a genuine asset, such as NEAR or a stablecoin.

A liquidity pool holds assets that users can exchange without a traditional buyer and seller matching each trade. One group of attacker-controlled wallets uses stolen cryptocurrency to purchase the new token.

Another group sells tokens into the same pool and withdraws the genuine asset. Because the pool sits between these transactions, funds do not move directly from the buying wallets to the collecting wallets.

The receiving accounts instead appear to have earned proceeds from token trading. Between November 5 and November 7, the operators created six NEAR tokens: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each cost approximately 25 NEAR, or $90, to launch.

Their logos copied familiar meme coin imagery, including animals and an Elon Musk-themed banner. Elliptic explicitly stated that nothing suggested Musk had any connection to the tokens. This method builds on earlier laundering after the Bybit theft.

While the earlier Bybit attack investigation described workstation compromise and malicious transaction changes, Elliptic’s research concerns what happened afterward: operators used a worthless Tron token and fresh wallets to move at least $24 million in stolen Bybit assets.

The Binance-linked NEAR tokens followed a consistent pattern. They launched, traded heavily within hours, and were abandoned. None had traded since November 8 when Elliptic published its findings.

Creators of four tokens also withdrew remaining pool liquidity that afternoon, reinforcing the assessment that these were temporary laundering tools rather than genuine trading projects.

Blockchain Evidence and Detection Priorities

Elliptic found that laundering-network wallets accounted for every sale across all six tokens. They also bought every unit of five tokens.

FUK attracted limited outside purchases, but these represented less than 1% of its volume. DABI, MMLI, and SINU each had only one buying wallet and one selling wallet.

Funding relationships provided another link. Five token creators received money from wallets that had already sold an earlier token, just two to thirteen minutes before launching the next one.

Almost the same amount of NEAR entering the scheme later left collecting wallets, often heading into stablecoins or cross-chain bridges.

The activity remains traceable because transactions stay on public blockchains. As previous reporting on Lazarus crypto laundering networks illustrates, connecting wallet movements with other evidence can support investigations and freezes.

Here, the extra swaps create delays rather than erase the trail, buying operators time before services flag their funds. Elliptic advises compliance teams against treating liquidity-pool withdrawals as automatically legitimate.

Newly launched tokens, very few traders, separate buying-only and selling-only wallets, and accounts funded immediately before trading deserve scrutiny. Previously accepted deposits also need renewed screening when investigators identify additional laundering addresses.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post North Korean Hackers Create Fake Meme Coins to Launder Stolen Funds From $6.4 Billion Binance Hack appeared first on Cyber Security News.