North Korean hackers are creating memecoins to wash loot from $6.3 billion Binance hack
- Published
- Updated
North Korea-linked hackers have used newly created memecoins as part of laundering tied to the Binance hack, with one report putting the amount moved at about $430,000 through decentralized exchange pools. Another report says the same laundering pattern involves a much larger $6.3 billion Binance hack and that the tokens were created to wash stolen funds.
Key claims & sources
What it means
Binance has been a recurring reference point for laundering concerns because the exchange has already been linked to a large hack, and memecoins now sit inside that same story. Elliptic’s Nov. 9 report places the latest activity in decentralized exchange pools, which are a common venue for moving tokens without a centralized intermediary. The North Korea angle matters because it connects this case to a long-running pattern of theft and laundering attributed to state-linked actors.
For people who trade, build, or monitor crypto markets, the practical issue is that newly minted tokens can be used as wrappers for moving stolen value. That means token creation is not just a market event; it can also be part of the mechanics of hiding provenance across chains and pools. The use of memecoins here shows how quickly a low-friction asset can be turned into a laundering tool. (per coindesk.com)
The wider stake is the same tension that sits under much of crypto enforcement: open token issuance and decentralized liquidity can support experimentation, but they also leave room for rapid abuse. Binance’s name in both reports shows how a single exchange can remain part of the public record long after a breach, especially when funds are broken up into smaller transfers. This is also a test of whether on-chain tracing can keep up with fast-moving, low-value token launches used for concealment.
What is still open is how much of the full Binance-linked haul has been traced and whether the same memecoin pattern keeps appearing in later transfers. The reports give one amount and identify specific tokens, but they do not show the full path of every transferred asset or the people behind each transaction. Further on-chain tracing or new disclosures would be needed to show whether this was a one-off technique or part of a broader laundering playbook.
Market reaction i
The total crypto market rose 1.0% in the 4 hours after the first headline, after rising 0.4% in the 2 hours before.
27 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
BeInCrypto
context
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 12 days ago | Binance CEX · Key Leaked via Infrastructure incident | $6.4B |
| 12 days ago | Binance · DevOps Engineer’s laptop compromised incident | $6.3B |
| 5.9 years ago | LuBian · Weak key generation incident | $3.5B |
| 5.6 years ago | Thodex · Scam incident | $2.5B |
| 5.4 years ago | Africrypt · Scam incident | $2.3B |
4290 incidents stored · 2 were as large as this one or larger ($6.3B)