Disposable Meme Coins Become North Korea’s Latest Crypto Laundering Trick

Key Takeaways:

• About $430,000 in stolen NEAR was channeled into six newly minted meme coins by the North Korean linked launderers.
• The tokens were used to act as a sacrificial buffer between stolen and receiving wallets on decentralized exchange liquidity pools.
• The method is still discoverable onchain but may impede investigators or complicate compliance screening, says Elliptic.

User Score

8.7

One interesting way hackers who were responsible for Binance’s massive compromise have laundered the money is by making their own meme coins and trading through liquidity pools before letting them burn.

Blockchain analytics firm Elliptic identified the technique while tracing funds from the $6.43 billion Binance hack, which the FBI has attributed to North Korea’s TraderTraitor group.

Read More: North Korea Rejects $6.3B Binance Crypto Heist Claims, FBI Blames TraderTraitor

The laundering network established during Nov. 5-11 produced at least 6 tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI and SINU. According to Elliptic, approximately 117,000 NEAR valued at approximately $430,000 have been processed by the tokens in the liquidity pools. The creation of each token represents a cost of approximately $90 per token.

There was virtually no trading of the coins in the market. Wallets that appeared to be involved in the laundering operation made all sales on all 6 tokens and almost all purchases, Elliptic determined. Within hours most were sold and were dumped. No one had been trading since Nov. 8, on the day after Elliptic had released its analysis.

Between the stolen crypto and the wallet getting the proceeds is a laundering process.

First, the attackers create another token paired with a real token, like NEAR, in a decentralized exchange liquidity pool. Then the stolen NEAR from one wallet is used to purchase the token, which has just been created. The other wallet sells back that token to the wallet pool and withdraws NEAR from it.

Therefore, the stolen assets never skip the first wallet directly to the wallet that collects them. At face value, the receiving address seems to be acquiring stolen funds through an obscure meme coin.

The blockchain trail is still visible, however. Elliptic said the strategy creates friction for investigators rather than making the funds untraceable.

The NEAR activity represents just one component of a much bigger laundering industry. Through the use of more than 20,000 wallets, 16 blockchains, at least 36 services and around 65,000 transactions, Elliptic has tracked the proceeds of Binance’s hack. In the above, they reported they had approximately $3 billion in addresses that they believed had been stolen.

There have been similar token-based approaches implemented on other blockchain systems, such as Tron and Solana. In addition, Elliptic connected it to the infamous Bybit hack in 2025, where North Korean-affiliated thieves are said to have funneled over $24 million through an illusory token launched on the Tron network.

One of the new red flags for crypto compliance teams is when funds come into the system from a liquidity pool on a decentralized exchange that has just been launched with minimal trading volume.

Read More: Binance Reveals How Hackers Moved $6.34B After Breaching Its Wallet-Signing System

The post Disposable Meme Coins Become North Korea’s Latest Crypto Laundering Trick appeared first on CryptoNinjas.