North Korean Hackers Turn to Memecoins to Hide Money Stolen in Binance Breach

North Korea launched at least six fresh tokens on the NEAR network between Nov. 5 and 7 to clean up part of the loot from the $6.3 billion Binance hack. About $430,000 passed through these tokens. One group of wallets swapped stolen NEAR for the new coins inside decentralized exchange liquidity pools, and a second group sold those coins back into the pools for NEAR. This let the attackers skip direct transfers between wallets, although every step stayed visible onchain. Almost nobody else traded the tokens, and they were dropped soon after going live.

Clues That Connect the Six Tokens

Elliptic found that five of the six token creators received funding from earlier token sales just two to 13 minutes before the next launch, which tied the whole set together as one chain.

Layered Tactics Seen Before in the Bybit Hack

Elliptic cofounder Tom Robinson said North Korean launderers seldom depend on one method. They stack many cheap tricks, and each one buys a little more time. The same approach appeared after the $1.5 billion Bybit hack in 2025, when linked actors pushed at least $24 million through a newly created token on TRON.

Stolen NEAR Still Sitting Untouched

When Elliptic carried out its analysis, roughly 11.8 million NEAR taken in the Binance theft had not moved, a stash the firm valued at $43.7 million.