North Korean hackers are creating memecoins to wash loot from $6.3 billion Binance hack
- Published
- Updated
North Korea-linked actors used newly minted memecoins to move part of the crypto tied to Binance’s large hack, with Elliptic tracing activity across NEAR and other chains. The tokens included animal themes and a fake Elon Musk presidential motif, and the routing moved through liquidity pools before trading stopped on Nov. 8.
Key claims & sources
What it means
Exchanges and decentralized platforms on TRON, Solana and NEAR now face a laundering method that doesn't touch a mixer, so wallet-screening tools built to flag mixer deposits miss it entirely. Compliance teams must instead watch for brand-new, low-liquidity tokens appearing briefly in DEX pools before being abandoned. NEAR's ecosystem absorbed roughly $430,000 of the traced flow, meaning its DEXs and liquidity providers unknowingly processed stolen funds without any direct transfer ever showing up on-chain.
Permissionless token creation, the feature that lets anyone launch a coin on a DEX without approval, is exactly what makes this scheme work, and that is an uncomfortable fact for an industry that markets open token issuance as a feature rather than a risk. Using an unauthorized 'Elon 2028 President' image shows the operators also exploit reputational cover from public figures, a tactic that complicates both detection and any argument that memecoin culture is harmless noise. (per bitcoinmagazine.com)
Watch whether Elliptic or other analytics firms trace further movement of the roughly $430,000 already identified across the six tokens, FUK, OLCCL and MEILI among them, and whether NEAR, TRON or Solana-based DEXs move to delist or freeze pools tied to them. A follow-up Treasury or OFAC action naming new wallets or token contracts would confirm regulators are treating memecoin laundering as a distinct enforcement priority rather than a one-off curiosity.
Market reaction i
The total crypto market rose 0.5% in the 4 hours after the first headline, after rising 0.4% in the 2 hours before.
47 prices, one every 30 minutes
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 14 days ago | Binance CEX · Key Leaked via Infrastructure incident | $6.4B |
| 14 days ago | Binance · DevOps Engineer’s laptop compromised incident | $6.3B |
| 5.9 years ago | LuBian · Weak key generation incident | $3.5B |
| 5.6 years ago | Thodex · Scam incident | $2.5B |
| 5.4 years ago | Africrypt · Scam incident | $2.3B |
4300 incidents stored · 0 were as large as this one or larger ($6.4B)