Key Highlights:
- Blockchain analytics firm Elliptic identified a novel money laundering scheme involving six custom-created memecoins used to disguise funds stolen from Binance.
- Attackers linked to North Korea laundered roughly 117,000 NEAR tokens, valued at approximately $430,000, through decentralized liquidity pools between November 5 and November 7.
- The illicit wash trading strategy involved buying and selling the custom memecoins across separate wallet clusters to mimic legitimate, profitable crypto trading gains.
Novel Laundering Tactics Obfuscate Stolen Binance Funds
Cybercriminals linked to North Korea have deployed an unprecedented money laundering technique designed to obscure the blockchain trail of digital assets stolen from cryptocurrency exchange Binance. According to investigative findings released by blockchain analytics firm Elliptic, the threat actors fabricated trading volume and market activity by creating six custom memecoins to wash stolen decentralized assets.
The laundering scheme involved approximately 117,000 NEAR tokens, which carried an estimated market value of $430,000 at the time the transactions took place. Rather than relying on traditional mixers or standard decentralized cross-chain bridges, the perpetrators engineered a complex decentralized finance (DeFi) mechanism to mask the direct path of the compromised capital.
Fabricated Memecoin Ecosystems on Decentralized Exchanges
Elliptic’s forensic research reveals that the operatives minted the six memecoins between November 5 and November 7. Immediately following token creation, the attackers set up dedicated NEAR liquidity pools for each of the six new tokens on a decentralized exchange. This established an isolated, liquid market environment that the attackers could control completely without relying on outside market participants.
To execute the wash trading scheme, the perpetrators deployed two distinct clusters of cryptocurrency wallets:
- Acquisition Wallets: The first cluster utilized the stolen NEAR tokens to purchase the freshly minted memecoins from the newly created liquidity pools.
- Liquidation Wallets: A secondary, separate group of wallets subsequently sold the same memecoins back into the pools to retrieve clean NEAR tokens.
By cycling the funds through self-funded pools, the attackers avoided direct wallet-to-wallet transfers that typically alert blockchain monitoring software. This tactical rotation made the incoming NEAR assets appear to on-chain observers as proceeds generated from exceptionally profitable, highly successful speculative memecoin trades rather than stolen exchange reserves.
Why This Matters
This incident highlights a sophisticated shift in cyber laundering operations, specifically by state-sponsored cyber syndicates associated with North Korea. As centralized exchanges and compliance firms tighten monitoring protocols on traditional crypto tumblers and mixing protocols, malicious actors are actively developing tailored DeFi infrastructure to bypass automated tracking systems.
By exploiting decentralized exchange liquidity mechanisms and fabricating memecoin market activity, illicit groups continue to challenge standard compliance algorithms. The tactic demonstrates that token creation and wash trading are increasingly being repurposed from market manipulation schemes into sophisticated transaction-obfuscation channels.
Frequently Asked Questions
How much cryptocurrency was laundered in this operation?
The attackers laundered approximately 117,000 NEAR tokens, which were valued at around $430,000 at the time the transactions were conducted.
When were the memecoins created and deployed?
According to Elliptic’s blockchain analysis, the six custom memecoins were created between November 5 and November 7, accompanied by individual decentralized exchange liquidity pools.
Why did the attackers use memecoins instead of regular transfers?
Direct transfers between wallets leave clear transaction links that trigger automated alerts from compliance and analytics platforms. By wash trading through independent wallets and custom liquidity pools, the perpetrators attempted to disguise stolen Binance funds as legitimate trading profits from successful speculative token investments.
