North Korean hackers are creating memecoins to wash loot from $6.3 billion Binance hack

76Importance
no updates 6h+Status
11News media
Published
Updated

North Korea-linked actors used newly minted memecoins to move part of the crypto tied to Binance’s large hack, with Elliptic tracing activity across NEAR and other chains. The tokens included animal themes and a fake Elon Musk presidential motif, and the routing moved through liquidity pools before trading stopped on Nov. 8.

Key claims & sources

✓
Elliptic identified token names including FUK, OLCCL, and MEILI in the laundering activity.
✓
One token showed Elon Musk under an “Elon 2028 President” banner, and Elliptic said Musk had no connection to the token.
✓
The activity was linked to memecoins on TRON, Solana, and NEAR in reporting on the Binance hack.
✓
Elliptic tied roughly $430,000 in NEAR to six memecoins built around animal themes and a fake Elon Musk presidential campaign reference.
✓
North Korea-linked launderers created six memecoins on the NEAR blockchain between Nov. 5 and 7 to move funds tied to the Binance theft.
✓
About 117,000 NEAR passed through the tokens’ liquidity pools before trading stopped on Nov. 8.

What it means

Exchanges and decentralized platforms on TRON, Solana and NEAR now face a laundering method that doesn't touch a mixer, so wallet-screening tools built to flag mixer deposits miss it entirely. Compliance teams must instead watch for brand-new, low-liquidity tokens appearing briefly in DEX pools before being abandoned. NEAR's ecosystem absorbed roughly $430,000 of the traced flow, meaning its DEXs and liquidity providers unknowingly processed stolen funds without any direct transfer ever showing up on-chain.

Permissionless token creation, the feature that lets anyone launch a coin on a DEX without approval, is exactly what makes this scheme work, and that is an uncomfortable fact for an industry that markets open token issuance as a feature rather than a risk. Using an unauthorized 'Elon 2028 President' image shows the operators also exploit reputational cover from public figures, a tactic that complicates both detection and any argument that memecoin culture is harmless noise. (per bitcoinmagazine.com)

Watch whether Elliptic or other analytics firms trace further movement of the roughly $430,000 already identified across the six tokens, FUK, OLCCL and MEILI among them, and whether NEAR, TRON or Solana-based DEXs move to delist or freeze pools tied to them. A follow-up Treasury or OFAC action naming new wallets or token contracts would confirm regulators are treating memecoin laundering as a distinct enforcement priority rather than a one-off curiosity.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The total crypto market rose 0.5% in the 4 hours after the first headline, after rising 0.4% in the 2 hours before.

$2.5T market cap at the headline
+0.4% 2 h before
+0.5% 4 h after
+0.5% 12 h after
First headline

47 prices, one every 30 minutes

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Nov 9 15:00
+49 min
Nov 9 15:49
crypto.news adds
Sharpens the figure: $6.4B, with quotes
+1 h 34 m
Nov 9 16:34
BeInCrypto context
Its angle: automated, protocol, estimate; with quotes
+2 h 26 m
Nov 9 17:26
Bitcoin Magazine adds
Adds $225M and $43.7M, with quotes
+2 h 51 m
Nov 9 17:52
Protos context
Its angle: introducing, reportedly, equivalent
+3 h 12 m
Nov 9 18:12
+4 h 35 m
Nov 9 19:36
Decrypt echo
No new facts: complete, routing, break; with quotes
+15 h 31 m
Nov 10 06:31
Crypto News Australia adds
Breaks the figures down; the largest, $9.2B, with quotes
+22 h 18 m
Nov 10 13:18
Cryptonews.com echo
No new facts: abandoned, launches, presales; with quotes
+1 d 8 h
Nov 10 23:25
Crypto Briefing adds
Sharpens the figure: $6B

Thefts of a similar size

WhenWhat happenedFigure
14 days ago Binance CEX · Key Leaked via Infrastructure incident $6.4B
14 days ago Binance · DevOps Engineer’s laptop compromised incident $6.3B
5.9 years ago LuBian · Weak key generation incident $3.5B
5.6 years ago Thodex · Scam incident $2.5B
5.4 years ago Africrypt · Scam incident $2.3B

4300 incidents stored · 0 were as large as this one or larger ($6.4B)