North Korean money launderers are generating their own valueless meme coins, routing stolen Binance assets through them so the funds never transfer directly between wallets, according to a Monday report from blockchain analytics firm Elliptic.
Between November 5 and 7, the operators minted at least six new tokens on the NEAR blockchain—specifically named FUK, OLCCL, MEILI, MMLI, DABI, and SINU. They paired each token with NEAR in individual liquidity pools, purchased the tokens using stolen NEAR, and subsequently sold them out through a secondary collection of wallets. Elliptic reported that approximately 117,000 NEAR, valued at roughly $430,000, moved through these six tokens.
This activity forms part of the wider laundering operation tied to the October 29 Binance theft, which the exchange values at $6.34 billion and the FBI attributes to North Korea‘s TraderTraitor group. Elliptic’s updated figures indicate that approximately 3,000 BTC—worth about $225 million—has been converted from other stolen assets into new bitcoin addresses, while roughly 11.8 million NEAR, equivalent to $43.7 million from the breach, remains stationary.
“Most people think of meme tokens as joke coins whose prices rise and fall on hype,” wrote Elliptic co-founder and chief scientist Dr. Tom Robinson. “North Korea’s launderers have found a different use for them.”
How the homemade token trick works
The laundering mechanism follows a four-step process. North Korean launderers deploy a public launch tool to create a token, establish a liquidity pool matching it with a genuine asset like NEAR or a stablecoin, acquire the newly minted token using stolen funds from a primary group of wallets, and then liquidate it back into the same pool via a secondary set of wallets that harvest the real asset.
Because the liquidity pool acts as an intermediary, the stolen funds never transfer directly from the buying wallet to the collecting wallet. To an outside observer, the collecting wallets resemble regular traders who successfully offloaded a token for a profit.
Creation costs for each of the six NEAR tokens hovered around 25 NEAR, or roughly $90. The tokens experienced heavy trading within hours using stolen NEAR before being abandoned entirely. None have seen trading activity since November 8, and by that afternoon, the creators of four tokens withdrew the remaining liquidity. Five of the six token creators received funding from a wallet that had sold a preceding token just two to 13 minutes prior to the next launch, establishing a direct chain of tokens.
Elliptic previously identified a similar strategy during the laundering of the February 2025 Bybit theft—also linked to North Korea’s TraderTraitor group—where a worthless Tron token facilitated the movement of at least $24 million. Regarding the Binance case, the firm has also observed this tactic utilized on Tron, alongside a modified variant on Solana that relied on existing low-liquidity tokens instead of custom-minted ones.
A slowing tactic, not a disappearing act
While these meme coins do not conceal the funds—as every transaction remains publicly visible on-chain—they effectively buy time. Each additional step introduces delays for investigators while the launderers race to shift funds ahead of blocklists, and at roughly $90 per token, the creation cost is low enough to discard them afterward.
This aligns with the broader pattern Elliptic has monitored following the breach: over 20,000 wallets spanning 16 blockchains, at least 36 services, and a minimum of 65,000 transactions. Binance stated that the breach originated from a fake job interview and persisted for five months prior to any fund movements, though blockchain firms connected the exploit to TraderTraitor within a single day.
The conversion into bitcoin represents the largest monetary scale of the operation. All stolen SOL has already been swapped, bridged, or mixed, and a significant portion of the XRP trail has similarly routed into bitcoin. Elliptic noted that roughly $2.85 billion of the initial haul has been frozen, while only a negligible amount has likely been liquidated so far.
North Korea’s digital asset theft infrastructure is well established. Elliptic estimated the regime’s 2025 proceeds at over $2 billion, propelled largely by the $1.46 billion Bybit exploit, pushing its cumulative known crypto theft total past $6 billion prior to the Binance incident.
Binance has progressively restored withdrawal capabilities and stated that it absorbed customer losses utilizing its own reserves. The ultimate test for investigators remains whether these homemade liquidity pools can multiply faster than blocklists can flag them.
FAQ
Why is North Korea creating meme coins?
North Korean hackers create worthless meme coins to launder stolen crypto by passing funds through liquidity pools so they never move directly between wallets.
How much did the Binance hack cost?
The Binance exchange values the October 29 theft at $6.34 billion, and the FBI has attributed the attack to North Korea’s TraderTraitor group.
Do meme coins hide stolen crypto transactions?
No, every step of the transaction remains entirely public on-chain, but the extra hops buy launderers time to move funds before investigators can flag them.
How much does it cost to make these laundering tokens?
Each of the NEAR tokens created for the laundering scheme cost about 25 NEAR, or roughly $90, making them cheap enough to discard after a few hours of use.
