Nov 9, 2026, 10:00 a.m. EST
2 min read
Summary
- North Korean threat actors deployed six custom memecoins to obfuscate 117,000 NEAR, valued at roughly $430,000, stemming from the massive $6.3 billion Binance exploit, according to Elliptic.
- A designated group of wallets acquired these digital assets utilizing illicitly obtained NEAR, while a separate cluster liquidated them, disguising the capital as legitimate market gains rather than stolen assets.
- Virtually the entirety of the transaction volume originated from the perpetrators’ own addresses, with Elliptic noting that this tactic hampers tracking efforts while still preserving an onchain audit trail.
Cybercriminals originating from North Korea are generating bespoke memecoins to wash capital pilfered during the $6.3 billion Binance breach, employing simulated market activity to present the stolen currency as lawful earnings.
The attackers transferred roughly 117,000 NEAR tokens, valued at approximately $430,000, through half a dozen memecoins deployed between November 5 and November 7, as reported by blockchain intelligence agency Elliptic.
One particular cryptocurrency displayed a graphic of Elon Musk accompanied by an “Elon 2028 President” slogan, though Elliptic emphasized there is zero indication that Musk is associated with the assets. Their titles mimicked standard memecoin conventions, incorporating a vulgar joke alongside the “inu” suffix typical of canine-inspired cryptocurrencies.
The threat actors established a dedicated liquidity pool on a decentralized exchange for each memecoin paired against NEAR, subsequently utilizing one set of addresses to purchase the memecoins using illicit NEAR while employing another set to liquidate those identical memecoins back into NEAR, ensuring the capital never moved straight between a single pair of wallets. This mechanism creates the illusion that the money stems from lucrative speculative trading rather than a cyberheist.
“The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds,” Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.
Elliptic discovered that nearly the entire transaction volume stemmed from addresses linked to the obfuscation operation, with external purchasers representing under 1% of the activity for any given token. Exchange activity across all six digital assets ceased by November 8.
The FBI has attributed the October 29 Binance robbery to North Korea’s TraderTraitor collective. The digital thieves have additionally utilized THORChain to exchange looted holdings into bitcoin, a currency incapable of being frozen by any centralized authority.
Elliptic uncovered a comparable memecoin washing strategy following the 2025 Bybit breach, noting that these novel transactions obstruct investigations aimed at tracking the purloined capital without entirely eliminating the transaction history.
Originally published at https://www.coindesk.com/business/2026/11/09/north-korean-hackers-are-creating-memecoins-to-wash-loot-from-usd6-3-billion-binance-hack.
