North Korean launderers are creating their very own nugatory meme cash and pushing stolen Binance funds via them so the cash by no means transfer immediately from one pockets to a different, blockchain analytics agency Elliptic said Monday.
Between Nov. 5 and seven, the operators minted a minimum of six new tokens on the NEAR blockchain — named FUK, OLCCL, MEILI, MMLI, DABI and SINU — paired every with NEAR in its personal liquidity pool, then purchased the tokens with stolen NEAR and bought them again out via a second set of wallets. About 117,000 NEAR, or roughly $430,000, handed via the six tokens, Elliptic wrote.
The path sits contained in the broader laundering of the Oct. 29 Binance theft, which the trade has put at $6.34 billion and which the FBI has attributed to North Korea’s TraderTraitor group. Elliptic’s wider replace now places roughly 3,000 BTC — about $225 million — in new bitcoin addresses transformed from different stolen belongings, whereas about 11.8 million NEAR, or $43.7 million, from the theft has nonetheless not moved.
“Most individuals consider meme tokens as joke cash whose costs rise and fall on hype,” Elliptic co-founder and chief scientist Dr. Tom Robinson wrote. “North Korea’s launderers have discovered a unique use for them.”
How the home made token trick works
The method is a four-step hop. The North Korea launderers create a token with a public launch instrument, open a liquidity pool pairing it with an actual asset similar to NEAR or a stablecoin, purchase the brand new token with stolen funds from one set of wallets, then promote it again into the identical pool from a second set of wallets that accumulate the true asset.
At no level do the stolen funds switch immediately from a shopping for pockets to a amassing pockets, as a result of the pool sits in between. To an off-the-cuff observer, the amassing wallets appear to be strange merchants who bought a token at a revenue.
Every of the six NEAR tokens price about 25 NEAR, or round $90, to create. Every was traded closely inside hours utilizing stolen NEAR after which deserted. None has traded since Nov. 8, and that afternoon the creators of 4 of them withdrew what liquidity was left. 5 of the six token creators had been funded by a pockets that had simply bought an earlier token, between two and 13 minutes earlier than the subsequent launch, so the tokens kind a series.
Elliptic first reported the identical method within the laundering of the February 2025 Bybit theft, additionally attributed to North Korean group TraderTraitor, when a nugatory Tron token helped transfer a minimum of $24 million. Within the Binance case the agency has additionally seen the method on Tron and a detailed variant on Solana that used present thinly traded tokens moderately than home made ones.
A slowing tactic, not a disappearing act
The meme cash don’t conceal the funds. Each step is public on-chain. What they purchase is time. Every further hop slows investigators whereas launderers race to maneuver funds earlier than they’re flagged, and at about $90 apiece the tokens are low cost sufficient to throw away.
That matches the bigger sample Elliptic has tracked for the reason that theft: greater than 20,000 wallets on 16 blockchains, a minimum of 36 providers and a minimum of 65,000 transactions. Binance has said the assault started with a pretend job interview and ran for 5 months earlier than any cash moved. Blockchain companies linked the breach to TraderTraitor inside a day.
The conversion into bitcoin is the larger greenback story. All the stolen SOL has already been swapped, bridged or combined, and far of the XRP route has fed into bitcoin as effectively. About $2.85 billion of the unique haul has been frozen. A negligible quantity has probably been cashed out thus far, Elliptic mentioned.
North Korea’s crypto theft machine shouldn’t be new. Elliptic put the North Korean regime’s 2025 haul above $2 billion, pushed by the $1.46 billion Bybit exploit, and its cumulative identified complete above $6 billion even earlier than Binance.
Binance has reopened withdrawals in phases and mentioned it coated buyer losses from its personal funds. The check for investigators is whether or not home made liquidity swimming pools hold multiplying quicker than the blocklists catching as much as them.
