Mentioned in This Article
1. North Korea crypto hack proceeds are being washed through homemade memecoins
In a North Korea crypto hack laundering scheme uncovered by blockchain analytics firm Elliptic, hackers created six memecoins between November 5 and November 7 to wash about 117,000 NEAR, worth roughly 430,000 dollars, stolen in the 6.3 billion dollar Binance hack. The fake trading makes the proceeds look like ordinary profit, and by November 8 activity in all six tokens had stopped.
The amount moved this way is small next to the headline size of the theft, which the FBI has linked to a North Korean group. Even so, the technique is notable because it shows how the attackers adapt their methods as investigators and exchanges tighten their monitoring of the standard routes for cashing out stolen funds.
Elliptic says the approach slows down tracing but does not hide the funds entirely, since every swap and transfer still sits on a public blockchain where it can be followed by analysts willing to examine the trail.
Money laundering in crypto generally follows three stages: placing stolen funds into a position that can be moved, layering them through many transactions to obscure their origin, and finally integrating them into the legitimate economy. The memecoin trades fall in the layering stage, where the goal is to create distance and confusion between the theft and the eventual cash-out.
For readers following the Binance incident, the episode is a reminder that the work does not end when funds leave the victim. Analytics firms such as Elliptic track the onward journey, and their findings help exchanges decide which deposits to scrutinize or reject.
2. How does the memecoin laundering method work?
The scheme relies on a decentralized exchange, where anyone can create a token and pair it with another asset in a liquidity pool. According to Elliptic, each of the six memecoins was paired with NEAR in its own pool. That setup let the launderers swap stolen NEAR for their own tokens and later swap the tokens back.
One group of wallets bought the memecoins using the stolen NEAR, and a separate group of wallets sold the tokens back into the pools for NEAR. Funds never travelled directly between the two groups. Because the money appeared to flow through market trades, the final balance looked like proceeds from successful trading and not like stolen assets passing from one hand to the next.
Put simply, the thieves acted as both buyer and seller in a market they had built themselves. The only real purpose of the tokens was to give the stolen funds a plausible-looking history and add steps between the original theft and any later withdrawal.
A liquidity pool is a smart contract holding two assets that traders can swap against, with prices set automatically by the ratio between them. Anyone can seed a pool with a new token and a partner asset such as NEAR, which is why creating a convincing-looking market costs very little and takes very little time.
Trading with oneself to create an impression of genuine activity is often called wash trading. In traditional markets it is prohibited, and in crypto it is used both to inflate volumes and, as here, to disguise the source of funds. The key detail in this case is that the two groups of wallets never sent funds straight to each other, which removes the most obvious link an investigator would look for.
3. What did the six tokens look like?
The tokens were designed to resemble ordinary speculative memecoins. Their names followed the conventions of that corner of the market, including a crude joke and the word inu, a term common in dog-themed coins. One token carried an image of Elon Musk beneath an Elon 2028 President banner.
Elliptic stressed that there is no suggestion that Musk has any connection to the tokens. Using a famous name or face is a standard way to make a new coin look like part of a trend, and it can also attract outside buyers who might add to the apparent trading volume.
In this case, though, outsiders barely participated. Elliptic found that almost all the trading came from wallets tied to the scheme itself, and that outside buyers made up less than 1 percent of the volume of one of the tokens. The lack of real demand supports the view that the coins existed for laundering, not for investment.
Memecoins make convenient cover because the category is already full of jokes, celebrity references and short-lived tokens. A new coin with an absurd name draws little suspicion on its own, so a launderer can blend in with thousands of legitimate launches by speculators.
4. What did Elliptic say about the trading?
Tom Robinson, co-founder and chief scientist at Elliptic, summed up the pattern by saying the launderers made six of these crypto tokens and traded them only with themselves. That description captures the core feature of the method: the activity is a closed loop, and the apparent profits are produced by the same actors who supplied the capital.
Trading across all six tokens had ceased by November 8, only a few days after the first of them was created on November 5. The short life of the tokens is consistent with a one-off purpose. Once the stolen NEAR had been routed through the pools, there was no reason to keep the coins active.
Elliptic said the technique complicates tracing, since analysts must connect wallets that deliberately avoid direct transfers between each other. It added that the trail is not erased, and that the onchain record still allows the funds to be followed.
The pattern Elliptic describes is a useful signal for detection. Genuine memecoins usually attract a wide set of independent buyers and sellers, with volumes shaped by social media attention. A token whose volume comes almost entirely from a small cluster of related wallets looks very different on the chain, even if its name and image look familiar.
Because trading stopped by November 8, the evidence is now a fixed record. Analysts can study the wallets, timing and pool activity at their leisure, and any later movement of the proceeds can be compared with that history.
5. Who is behind the Binance hack?
The FBI has attributed the October 29 theft from Binance to TraderTraitor, a hacking group associated with North Korea. The attackers have used other tools to move value as well. They have relied on THORChain, a cross-chain protocol, to convert stolen assets into bitcoin, which cannot be frozen by a central issuer.
That last point is important for recovery efforts. Stablecoins and some other tokens are controlled by companies that can block specific addresses once they are flagged, while bitcoin has no such mechanism. Converting stolen funds into bitcoin therefore removes one of the few levers available to investigators and exchanges.
The memecoin trades appear to be a complementary step for a portion of the loot, a way to add distance between the theft and later cash-out points for the NEAR tokens in particular.
North Korea has been tied to some of the largest thefts in the industry, and the proceeds are widely understood to be of interest to the state. For that reason, exchanges and compliance teams treat funds linked to such groups as especially sensitive, and they have strong incentives to block or flag them quickly.
The use of several different laundering tools at once, including cross-chain swaps and homemade tokens, shows that the attackers spread the funds across multiple routes. That diversification makes it harder for any single party, whether an exchange, a protocol or an issuer, to intercept the full amount.
6. Has this laundering approach been used before?
Yes. Elliptic previously identified a similar memecoin-based laundering method after the 2025 Bybit hack, another large theft attributed to North Korean actors. The repeat use suggests that the attackers regard the technique as effective enough to reuse, even though it leaves a visible record.
The pattern also illustrates a wider challenge for the industry. Token creation is cheap and permissionless, so launderers can generate new assets and liquidity pools within minutes. Exchanges and analytics providers have to detect closed-loop trading in tokens that appear and disappear quickly, often before any alert can be raised.
For compliance teams, the lesson is that low trading volume and wallets that trade almost exclusively with one another can be signs of artificial activity. Monitoring tools that look at who is on both sides of a trade, not only at the token being traded, are better placed to spot this kind of behaviour.
Each new incident also gives analysts more examples to study. Techniques that appear once can be turned into detection rules, and the Bybit comparison allows researchers to see which elements of the playbook stay constant and which ones change from case to case.
7. What happens next?
No specific deadline or enforcement step was announced alongside the findings, so the next developments are likely to come from continued onchain monitoring. Analysts will keep following the NEAR and bitcoin movements linked to the Binance theft to see where the funds eventually go.
Elliptic's assessment is that the new trades complicate tracing without wiping out the trail. That leaves open the possibility that exchanges and law enforcement can still identify cash-out points if the wallets are labelled early and monitored closely.
The 117,000 NEAR laundered through the six tokens represents only a sliver of the stolen total. How the rest of the 6.3 billion dollars is being moved, and whether similar token-based schemes appear again, will determine how far the trail can be followed.
For ordinary users and exchanges alike, the practical takeaway is vigilance around unfamiliar tokens with sudden activity. Deposits connected to a known theft can create legal and reputational problems for a platform, so screening tools that follow funds through several hops, including swaps into new tokens, remain an important line of defence.