North Korean hackers are using newly launched meme coins to launder proceeds from the $6.3 billion Binance hack, according to blockchain analytics firm Elliptic. The operation involved six tokens created on the NEAR blockchain between November 5 and 7.
Elliptic traced around 117,000 NEAR tokens worth $430,000 through the six meme coins. The hackers used decentralized exchange liquidity pools to make the stolen funds appear to come from legitimate trades before moving them between wallets.
How Hackers Used Meme Coins
The process involved creating worthless tokens and pairing them with NEAR in liquidity pools. Separate wallets then purchased the tokens using stolen cryptocurrency, while other wallets sold them back to recover the underlying NEAR.
Related: Flare Joins XRP Ledger Unique Node List to Strengthen Network Security
Elliptic identified six tokens: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Its analysis found no meaningful trading activity outside the laundering network. Trading volumes surged shortly after launch before largely stopping.
Similar Tactics Used in Previous Hacks
A similar method was used in the 2025 Bybit hack, which was also linked to North Korea’s TraderTraitor group. In that case, hackers moved at least $24 million through worthless tokens on the Tron blockchain.
Elliptic estimated that approximately $43.7 million in stolen NEAR remained untouched. The hackers have also used THORChain to convert stolen assets into Bitcoin, making recovery more difficult.
Related: India’s ED Investigates CoinDCX and Delta Exchange Over Overseas Crypto Dealings
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
