North Korean hackers used six memecoins to launder $430,000 from the $6.3 billion Binance hack

North Korean hackers are now using memecoins as a laundering layer: according to Elliptic, they moved about 117,000 NEAR, worth roughly $430,000, through six tokens created between Nov. 5 and Nov. 7 after the Oct. 29 Binance theft. For PSPs and compliance teams, the useful detail is not the theater, it is the mechanism: onchain trading can be manufactured to make stolen funds look like market profit.

1. Elliptic says the six tokens were created specifically to wash proceeds from the $6.3 billion Binance hack. One token even used an image of Elon Musk under an “Elon 2028 President” banner, though Elliptic said there is no suggestion Musk is connected to the tokens.
2. The laundering method was simple and ugly in the way crypto often is: the hackers paired each memecoin with NEAR in its own liquidity pool on a decentralized exchange, then used one set of wallets to buy memecoins with stolen NEAR and another set to sell those same memecoins back for NEAR. The funds never moved directly from one wallet to another, which makes the flow resemble trading activity rather than hack proceeds.
3. Elliptic co-founder and chief scientist Tom Robinson told CoinDesk: “The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds.” Almost all trading came from wallets tied to the laundering scheme, with outside buyers accounting for less than 1% of one token’s volume.
4. Trading across all six tokens stopped by Nov. 8. Elliptic said the trick complicates tracing, but does not erase the trail: the activity is still visible onchain, just wrapped in a layer of fake market action.
5. The FBI has pointed to North Korea's TraderTraitor group as responsible for the Oct. 29 Binance theft. Elliptic also said the hackers used THORChain to convert stolen assets into bitcoin, which cannot be frozen by a central issuer.

Elliptic said it found a similar memecoin laundering method after the 2025 Bybit hack. For exchanges, acquirers, and crypto payment providers, the operational takeaway is straightforward: “memecoin trading” is no longer just retail noise; it can be a laundering rail, and the onchain trail is only as hard to follow as the team watching it.