North Korea Turns DIY Meme Coins Into a Laundering Pipe for Stolen Binance Crypto, Elliptic Says

Crypto launderers working for North Korea are spinning up disposable meme coins of their own to shuttle funds taken from Binance, blockchain analytics firm Elliptic said in a report published Monday. Over three days, Nov. 5 to Nov. 7, roughly 117,000 NEAR, about $430,000, was routed through six of the tokens.

The launderers paired each token with NEAR, the native coin of the NEAR Protocol blockchain, in its own liquidity pool, a pot of two assets on a decentralized exchange that anyone can swap against. One group of wallets paid stolen NEAR into the pool for the new token, and a second group sold the token back and pulled NEAR out. Because the pool sits in the middle, no transfer connects the two groups directly. “They exist only to put a pool between the stolen funds and the next wallet,” Elliptic wrote on X.

Days before the tokens appeared, Jonty, founder of Pangolin Intelligence, said on Unchained that the networks laundering for North Korea shuffle funds between wallets “to essentially evade the eyes of transaction monitoring software,” naming Chainalysis, TRM Labs and Elliptic as examples.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

The NEAR tokens, FUK, OLCCL, MEILI, MMLI, DABI and SINU, carried cartoonish meme-coin artwork: one showed a monkey sporting a pink bow, another a duck posed against an American flag, and a third put Elon Musk beneath an “Elon 2028 President” banner. Elliptic said there is no suggestion Musk has any link to them. Each cost about 25 NEAR, or around $90, to launch.

Elliptic said the trading data shows the tokens served no purpose beyond laundering. Outside traders were almost entirely absent. The laundering wallets themselves placed every sell order in all six tokens and every purchase in five of them; the lone exception was a sprinkling of FUK buys on launch day, a sliver of its trading. The tokens were also linked in a chain: in five cases, the wallet that bankrolled a new token’s creator had been dumping the prior token just 2 to 13 minutes before launch, so profits from one financed the next. None has traded since Nov. 8. That afternoon, four of the tokens’ creators pulled the funds still sitting in their pools.

The trick isn’t new. Elliptic says it first saw it after Bybit lost $1.5 billion in 2025, when launderers used a worthless Tron token to move at least $24 million. In the Binance case, a similar Tron token turned up on Nov. 2, and a day later stolen SOL, Solana’s native token, went through existing thinly traded Solana tokens.

The NEAR sums are small next to about $6.3 billion taken from Binance on Oct. 29, a theft the FBI attributed to North Korea’s TraderTraitor hacking group. About 11.8 million NEAR, worth $43.7 million, from the hack has not moved yet, according to Elliptic, which said the tokens are cheap to run and could carry far larger amounts.

Every step stays visible onchain. “The technique slows investigators down rather than hiding the funds,” Elliptic’s Tom Robinson wrote in the report. The firm told compliance teams not to treat funds coming out of a liquidity pool as clean by default, listing warning signs such as tokens only days old, pools with a handful of traders, and wallets that only buy or only sell.

Related Listen: How North Korea’s Launderers Try to Shake Off Blockchain Analytics

The post North Korea Turns DIY Meme Coins Into a Laundering Pipe for Stolen Binance Crypto, Elliptic Says appeared first on Unchained.