The company explained that the digital coins were minted in order to push the stolen funds through them, ensuring that the coins never move directly from one wallet to another. The tokens were named FUK, OLCCL, MEILI, MMLI, DABI and SINU, Elliptic said.
The activity sits inside the broader laundering of the Oct. 29 Binance hacking incident, which the exchange has put at $6.34 billion [1]. The Federal Bureau of Investigation (FBI) has attributed the theft to the TraderTraitor group, which is linked to Pyongyang [1].
"Most people think of meme tokens as joke coins whose prices rise and fall on hype," wrote Elliptic co-founder and chief scientist Dr. Tom Robinson. "North Korea's launderers have found a different use for them."
How the Token Laundering Method Worked
Elliptic explained that the North Korean launderers create a token with a public launch tool. They then open a liquidity pool and pair it with a real asset like NEAR or a stablecoin.
The launderers then buy the new token with stolen funds from one set of digital wallets, and then sell it back into the same pool from a second set of wallets that collect the real asset. The stolen funds never transfer directly from a buying wallet to a collecting wallet because the liquidity pool sits between them, Elliptic said.
Each of the six NEAR tokens cost about 25 NEAR, or around $90, to create, according to Elliptic. The company first reported the same approach in the laundering of the February 2025 Bybit theft, also attributed to TraderTraitor, when a Tron token helped move at least $24 million, according to the report.
Six Tokens Created, Traded and Abandoned
None of the six NEAR meme tokens has traded since Nov. 8, according to Elliptic, and that afternoon the creators of four of them withdrew what liquidity was left. The meme coins do not hide the funds; every step is public on-chain, the report stated.
Elliptic said the tokens buy time by adding hops while launderers race to move funds before they are flagged. The pattern reflects a broader shift in how state-linked actors use digital-asset infrastructure.
Binance Theft Probe Expands Across Blockchains
Elliptic's wider update put roughly 3,000 BTC, or about $225 million, in new bitcoin addresses converted from other stolen assets. Elliptic has tracked more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions since the theft. All of the stolen SOL has already been swapped, bridged or mixed, and much of the XRP route has fed into bitcoin as well, Elliptic said.
The FBI has publicly attributed the theft to North Korea, and North Korean officials have denied involvement, calling the accusations "absurd rhetoric" [2]. Kim Yo-Jong, director of the North Korean General Affairs Department, condemned the bureau's accusations in a statement and reiterated that Pyongyang is committed "to resolutely oppose all sorts of malicious acts in cyberspace" [2].
"The U.S. has made a trite provocation of linking it with the Democratic People's Republic of Korea (DPRK) again," said Kim, the sister of North Korean leader Kim Jong-Un. "It is a grave political provocation against the DPRK that the U.S. misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds" [2].
Outlook: Blocklists Race Against Homemade Pools
The report stated that the test for investigators is whether homemade liquidity pools keep multiplying faster than blocklists catch up to them. The episode also illustrates a structural tension in decentralized finance. The same public-ledger transparency that lets analysts trace stolen funds in detail also gives launderers a predictable, low-cost surface for adding hops.
References
- North Korea Is Minting Its Own Meme Coins to Launder Binance Hack Loot. https://bitcoinmagazine.com/news/north-korea-meme-coins-binance-hack
- North Korea denies being behind record $6.3bn Binance hack. https://bbc.com/news/articles/c6rey4v53exgo
Explainer Infographic
Please contact us for more information.
