How Did North Korean Hackers Use Memecoins to Launder Binance Funds?
2026-11-10
North Korean hackers have developed increasingly sophisticated methods to move stolen cryptocurrency across blockchain networks. In one investigation following the October 2026 Binance theft attributed to the North Korean-linked TraderTraitor group, blockchain analytics firm Elliptic identified an unusual laundering technique involving six homemade memecoins on NEAR Protocol.
Rather than transferring stolen funds directly between wallets, the actors used decentralized exchange (DEX) liquidity pools to disguise the movement of approximately 117,000 NEAR, worth around $430,000 at the time of the investigation.
The case illustrates how seemingly ordinary memecoin activity can become part of a larger crypto money laundering operation. It also raises questions about how investigators and compliance teams identify suspicious crypto transactions when funds move through newly created tokens and decentralized markets.
Key Takeaways
Elliptic traced approximately 117,000 NEAR, worth around $430,000, through six newly created memecoins linked to the laundering of stolen Binance funds.
The operation used DEX liquidity pools to separate wallets buying tokens with stolen funds from wallets selling tokens to collect NEAR.
Blockchain transactions remained traceable, but the use of homemade tokens and multiple wallets made the investigation more complicated.
How Did North Korean Hackers Use Memecoins to Launder Binance Funds?
According to Elliptic's investigation, the actors created their own memecoins and used DEX liquidity pools to move stolen NEAR between different wallets.
The method avoided a straightforward transfer from a wallet holding stolen funds to a wallet collecting the proceeds. Instead, one group of wallets purchased newly issued tokens using stolen NEAR, while another group sold those tokens into the same liquidity pools and withdrew NEAR.
The two sets of wallets effectively used token trading as an intermediary. The amount of NEAR withdrawn was almost equal to the amount deposited, suggesting that the token transactions were being used to move value rather than support genuine market activity.
This approach reflects a broader challenge in crypto money laundering: decentralized platforms can provide additional transaction layers that make it harder to identify the original source and destination of funds.
For background on the incident, readers can explore Bitrue's coverage of the Binance hack and North Korea's TraderTraitor operation.
Six NEAR Memecoins Used in the Laundering Scheme
Elliptic identified six tokens created between November 5 and November 7, 2026. Each reportedly cost approximately 25 NEAR, or around $90, to create.
The tokens were:
FUK: Created on November 5 at 00:25 UTC.
OLCCL: Created on November 6.
MEILI: Created on November 6.
MMLI: Created on November 6.
DABI: Created on November 6.
SINU: Created on November 7 at 10:06 UTC.
The four tokens OLCCL, MEILI, MMLI, and DABI were created on November 6, between 07:19 and 14:27 UTC.
The investigation found several indicators that these tokens were not being used for ordinary speculative trading. DABI, MMLI, and SINU each had only one buyer and one seller wallet. The same network of wallets purchased all units of five of the six tokens and handled the sales. FUK recorded a few small purchases from outside wallets, but these represented less than 1% of its trading volume.
These patterns suggest coordinated activity rather than independent participation by a broad community of traders.
How the $430K in Stolen NEAR Moved Through DEX Liquidity Pools
The investigation traced approximately 117,000 NEAR, valued at around $430,000, through the six tokens.
The process involved two distinct groups of wallets. The first group used stolen NEAR to buy the newly created memecoins. The second group sold those tokens into the same liquidity pools and withdrew NEAR.
This created an indirect route between the wallets holding the stolen funds and those collecting the proceeds. The tokens functioned as an intermediary, making the movement look like a series of trades rather than a direct transfer.
Elliptic also identified links between the wallets through their funding histories. Five of the six token creators received funding from a wallet that had sold an earlier token just two to thirteen minutes beforehand. This timing helped investigators connect activities that might otherwise appear unrelated.
After the token trades, some of the proceeds were moved into stablecoins or through cross-chain bridges. These additional movements created further steps for investigators to follow.
The activity eventually stopped. None of the six tokens recorded trades after November 8, and the creators withdrew the remaining liquidity from four pools on that date.
Was the Entire Binance Stolen Fund Laundered Through NEAR Memecoins?
No. The approximately $430,000 traced through the six NEAR memecoins represents one part of a much larger incident.
Elliptic's investigation also identified a remaining balance of approximately 11.8 million NEAR, worth around $43.7 million, that had not yet moved at the time of its analysis.
The distinction matters because the NEAR memecoin activity should not be interpreted as the full amount stolen from Binance. It was a specific laundering route identified within the broader investigation.
The incident also involved activity across other blockchain networks. Elliptic described a sequence of movements that included a homemade token on Tron on November 2, stolen SOL exchanged through wrapped and thinly traded Solana tokens before conversion into USDC and cross-chain transfers on November 3, and the six NEAR memecoins between November 5 and 7.
The use of different networks and token mechanisms demonstrates how investigators may need to follow funds across multiple blockchain ecosystems.
How to Trace Stolen Crypto Through Suspicious Token Activity
Using memecoins does not make stolen cryptocurrency invisible. Public blockchains preserve transaction records, allowing investigators to examine wallet histories, token transfers, liquidity pool activity, and funding relationships.
However, the process can become more complicated when criminals create tokens specifically to facilitate transfers. Investigators must look beyond individual transactions and examine how wallets interact over time.
Several warning signs can help identify suspicious activity:
Newly created tokens with limited trading history. Tokens launched shortly before large transactions deserve closer examination.
A small number of connected wallets. Trading dominated by a handful of wallets may indicate coordinated activity.
Separate buyer and seller groups. Different wallets buying and selling the same token can be suspicious when their funding histories are connected.
Wallets funded shortly before trading. Newly funded wallets that immediately participate in token transactions may warrant additional scrutiny.
Unusual liquidity withdrawals. Liquidity removed shortly after a series of coordinated trades can indicate that the pool was used as a temporary intermediary.
For a practical overview of the investigation process, Bitrue's guide explains how to trace crypto transactions and check suspicious wallets.
These indicators do not independently prove criminal activity. They provide a basis for further investigation, particularly when several patterns appear together.
What This Case Means for Crypto Exchanges and Compliance Teams
The Elliptic investigation highlights a challenge for exchanges, compliance teams, and blockchain analytics providers. Monitoring direct transfers alone may not be enough when stolen funds move through token swaps, DEX liquidity pools, and cross-chain bridges.
A deposit originating from a DEX interaction should not automatically be treated as legitimate. Compliance teams may need to examine the token's launch date, trading concentration, wallet funding history, and the relationship between buyers and sellers.
At the same time, the investigation does not suggest that the DEX, token creation tool, or wallet application involved was responsible for the laundering. The reported technique relied on using available blockchain infrastructure to move funds through ordinary transaction functions.
The broader lesson is that suspicious activity can be identified through transaction patterns and wallet relationships, even when the route involves multiple tokens and platforms.
Conclusion
The use of six homemade NEAR memecoins shows how North Korean-linked actors allegedly used decentralized trading mechanisms to complicate the movement of stolen Binance funds. By separating token buyers from sellers and routing NEAR through liquidity pools, they created an indirect path for approximately $430,000 in cryptocurrency.
The technique added complexity to blockchain investigations, but it did not erase the transaction trail. Wallet funding patterns, token trading activity, and liquidity movements provided investigators with evidence to connect the transactions.
For crypto exchanges and users, the case reinforces the importance of examining transaction history and wallet relationships rather than judging a transfer by its immediate appearance.
Explore Crypto Trading on Bitrue
Understanding how stolen cryptocurrency moves across blockchains is important for anyone participating in the digital asset market. Before interacting with unfamiliar tokens or wallets, take time to review transaction histories and understand the risks involved.
Explore digital asset markets and trading opportunities on Bitrue by creating an account.
FAQ
How did North Korean hackers launder Binance funds?
They reportedly used homemade memecoins and DEX liquidity pools to move stolen NEAR between separate groups of wallets.
How much Binance cryptocurrency was traced through NEAR memecoins?
Elliptic traced approximately 117,000 NEAR, worth around $430,000, through six tokens.
Which memecoins were involved?
The six tokens were FUK, OLCCL, MEILI, MMLI, DABI, and SINU.
What is the role of DEX liquidity pools in crypto laundering?
Liquidity pools can act as intermediaries, allowing actors to exchange tokens and move value without making a direct transfer between the original and receiving wallets.
Can investigators trace stolen cryptocurrency after token swaps?
Yes. Public blockchain records allow investigators to examine transaction histories, wallet funding, token trades, and liquidity movements.
Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.
Disclaimer: The content of this article does not constitute financial or investment advice.
