North Korea’s Binance hackers launch six memecoins, trade only with themselves to fake clean profits

North Korean hackers moved about $430,000 in stolen Binance assets through six memecoins they created themselves, according to blockchain analytics firm Elliptic.

In research published on November 9, Elliptic traced approximately 117,000 NEAR through tokens launched between November 5 and 7. The activity represents a small portion of the wider theft, which Chainalysis estimates at $6.4 billion.

Stolen funds disguised as trading profits

The operation used trading pools to separate wallets holding stolen funds from wallets collecting the proceeds.

According to CoinDesk’s reporting on the findings, one group of wallets bought the newly created tokens with stolen NEAR. Another group sold tokens into the same pools, collecting NEAR on the other side.

That made the receiving wallets appear to have earned money from trading, rather than received assets from a hack.

“The launderers made six of these crypto tokens, and traded them only with themselves,” Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.

Six tokens, brief trading bursts

Elliptic identified the tokens as FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each cost approximately 25 NEAR, or $90, to create.

The firm said linked wallets dominated their trading. Outside purchases accounted for less than 1% of FUK’s volume, while the other five tokens’ buying activity came entirely from the laundering network.

None of the six had traded since November 8. Five token creators received funding from wallets that had sold an earlier token, connecting the launches through their proceeds.

Elliptic also identified a comparable operation on Tron and a related approach involving existing, thinly traded tokens on Solana.

FBI links Binance theft to North Korea

The FBI attributed the October 29 Binance attack to North Korean actors it tracks as TraderTraitor.

In its October 31 alert, the bureau said more than $6 billion had been stolen. It reported that the attackers were converting assets primarily into ether and anticipated further laundering through decentralized finance platforms and instant-swap services.

The FBI urged exchanges, blockchain infrastructure operators and other crypto businesses to block transactions involving addresses connected to the theft.

Separately, Chainalysis said funds stolen from Binance had mixed with proceeds from an earlier Bitget theft attributed to North Korea. The firm cited that on-chain connection as evidence supporting its attribution.

Chainalysis reported that approximately $2.8 billion had been frozen as of November 3, as investigators and stablecoin issuers worked to prevent further movement of stolen assets.

The firm also observed thousands of transactions and repeated funding patterns suggesting parts of the laundering operation were automated.

The memecoin transactions remain visible on-chain, Elliptic said. Their purpose is to complicate tracing and buy time, rather than erase the money trail.