Binance Hackers Are Laundering Loot Through Meme Coins

The crew that drained roughly $6.3 billion from Binance has started minting meme coins. Nobody is meant to buy them. They exist so stolen money has somewhere to hide for a few hours.

The story spread fast on X, where StalkHQ flagged the meme coin launches, and the details come from a Monday report by blockchain analytics firm Elliptic. According to Elliptic, launderers working for North Korea's TraderTraitor group created at least six throwaway tokens on NEAR between November 5 and 7. One carries a monkey in a pink bow. Another has a duck wrapped in a US flag. One shows Elon Musk under an "Elon 2028 President" banner, which Elliptic says has nothing to do with Musk. The names include FUK and SINU.

The amounts are small. About 117,000 NEAR, roughly $430,000, passed through the six tokens, which is under 0.01% of the haul. The method is the part worth watching.

We already covered the hack itself when it hit. Short version: on October 29 attackers moved out billions in about 20 minutes, and CEO Richard Teng later said the attacker used a self-destruct mechanism that wiped tooling and traces along the way. The FBI named TraderTraitor two days later. It is the same group the bureau blamed for the $1.4 billion Bybit theft in 2025.

How a Worthless Token Cleans Real Money

The trick is simple, and cheap. Each token cost about 25 NEAR, around $90, to launch. The launderers pair it with a real asset like NEAR in a liquidity pool on a decentralized exchange. One set of wallets pays stolen funds into the pool and gets the new token back. A second set of wallets sells the token into the same pool and pulls out clean-looking NEAR.

Stolen money never moves directly from the first set of wallets to the second. The pool sits in between, and the receiving wallets look like ordinary traders who sold a meme coin at a profit. Elliptic co-founder Tom Robinson put it plainly on X: the coins are a disguise, but every step is onchain and Elliptic traced it.

Elliptic's evidence that these tokens never had a real market is hard to argue with. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. Five of the six creators were funded by a wallet that had been selling the previous token a few minutes earlier, so each coin paid for the next. All six were first sold within three hours of launch and then dumped. None has traded since November 8, and the creators of four pulled out the leftover liquidity that afternoon.

Not new, just bigger

North Korea did this before. Elliptic first saw it after the Bybit hack, when at least $24 million went through a worthless token on Tron. This time the crew got there within days. A Tron token showed up on November 2, and on November 3 stolen SOL was swapped into thinly traded Solana tokens before being sold for USDC. The NEAR batch came later in the week.

Meme coins make decent cover because thousands launch every day and most die within days. A wallet with a fresh cartoon token in its history looks like a speculator, not a launderer, unless someone checks where the money came from.

A sideshow to the main machine

Elliptic is clear that this layer does not hide anything. It slows investigators down, and in a laundering race, delay is the point.

The bigger operation looks different. Elliptic's tally now covers more than 20,000 wallets across 16 blockchains and at least 36 services. Early in the week, the firm said funds were hopping to a new wallet about every 25 seconds, and Robinson described it as laundering on autopilot, probably automated with human oversight. Elliptic's own warning was that static lists and one-off checks will miss a cluster like this. Chainalysis also pointed to the automation behind the laundering.

Other routes are open too. About 7,000 ETH, roughly $15 million, has gone into Tornado Cash since Sunday. Around 3,000 BTC, about $225 million, now sits in fresh bitcoin addresses, and some stolen funds have moved through THORChain, which podcasters were already debating in the context of the FBI's attribution.

Part of the haul never got the chance. The FBI says $2.85 billion was frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. TRM puts the figure closer to $2.7 billion, and Binance says about $3 billion. Elliptic also reported that 11.8 million stolen NEAR, worth about $43.7 million, has not moved yet.

One caveat from the people who track North Korea for a living. Michael Barnhart at DTEX told Recorded Future News that TraderTraitor tends to hand money to Chinese laundering networks quickly, so some of what analysts see onchain may be those networks at work. Elliptic still labels the meme coin activity as North Korean.

What compliance teams should look for

Elliptic's advice is to stop treating liquidity pool funds as clean by default. A wallet funded through a swap can sit two steps from stolen money. The warning signs are a token created in the last few days, a pool with only a handful of traders, wallets that only buy or only sell, and new wallets funded in round amounts shortly before trading starts. The firm also publishes a free blocklist of Binance hack addresses and says it keeps updating it.

For now the number to track is that untouched 11.8 million NEAR.