Key Highlights
- North Korean cybercriminals are minting custom memecoins to launder digital assets linked to the $6.3 billion Binance exploit.
- Blockchain forensics firm Elliptic discovered that roughly 117,000 $NEAR tokens (worth approximately $430,000) were laundered through six bespoke memecoins created between November 5 and November 7.
- The illicit scheme involved wash trading across decentralized exchange liquidity pools, creating a false impression of trading gains without moving funds directly between criminal wallets.
North Korean Hackers Deploy Memecoins to Mask Stolen Binance Assets
State-sponsored cybercriminals from North Korea have expanded their money laundering techniques by designing custom memecoins to obfuscate capital seized during the historic $6.3 billion Binance exploit. According to a detailed investigation conducted by blockchain analytics firm Elliptic, the illicit actors deployed multiple bespoke digital tokens to simulate organic decentralized exchange activity, disguising stolen crypto assets as conventional market returns.
Between November 5 and November 7, the hacking operation channeled approximately 117,000 $NEAR tokens, valued at around $430,000, across six newly created memecoins. The newly minted assets were designed to mimic prevailing decentralized finance (DeFi) culture, using industry naming conventions such as crude jokes, the popular canine-themed suffix “inu,” and high-profile cultural references.
Wash Trading and Decentralized Liquidity Manipulation
One of the fraudulent tokens prominently featured a portrait of tech billionaire Elon Musk positioned beneath an “Elon 2028 President” banner. Elliptic clarified that there is no indication or suggestion that Elon Musk has any involvement with or connection to the illicit assets. Instead, the thematic branding was selected to mirror the volatile, community-driven tokens that frequently launch on open networks.
To execute the laundering sequence, the perpetrators launched dedicated liquidity pools on a decentralized exchange, pairing each customized memecoin with $NEAR. The group then deployed a coordinated network of digital wallets to execute wash trading. One cluster of wallets purchased the memecoins using the stolen $NEAR tokens, while an alternate group of wallets simultaneously liquidated those same tokens back into $NEAR. Because capital never transferred directly from one wallet address to the other, the resulting balances appeared on-chain as genuine trading profits rather than proceeds from a major cryptocurrency heist.
Why This Matters
The transition toward custom memecoin generation marks a sophisticated tactical shift in state-backed cybercrime and illicit finance. As centralized exchanges and compliance platforms strengthen their anti-money laundering (AML) controls and blockchain tracking capabilities, sophisticated threat actors are increasingly engineering custom on-chain infrastructure to break transaction trails. By fabricating trading volume across decentralized liquidity pools, the perpetrators bypass conventional automated tracing alerts, presenting a growing enforcement challenge for international regulators, DeFi protocol developers, and blockchain security researchers.
Frequently Asked Questions
How did North Korean hackers use memecoins to launder stolen funds?
The hackers generated their own memecoins on a decentralized exchange and funded liquidity pools paired with $NEAR. By using one set of wallets to buy the memecoins with stolen assets and another set to sell them, they made the movements look like successful, legitimate trading returns while severing direct on-chain links between the wallets.
How much money was moved during this specific laundering operation?
According to Elliptic, the hackers routed approximately 117,000 $NEAR tokens—valued at roughly $430,000—through six custom memecoins launched between November 5 and November 7.
Was Elon Musk affiliated with the political memecoin created in the scheme?
No. While one of the memecoins displayed an image of Elon Musk with an “Elon 2028 President” banner, blockchain analytics firm Elliptic affirmed that there is no suggestion that Musk had any link to or involvement with the tokens.
