North Korean hackers launder Binance hack funds via NEAR memecoins

North Korean hackers created at least six memecoins on the NEAR blockchain to launder cryptocurrency stolen in the $6.3 billion Binance hack, routing roughly $430,000 through decentralized liquidity pools between Nov. 5 and Nov. 7, according to blockchain analytics firm Elliptic.

How NEAR memecoins helped obscure stolen funds

Elliptic said the actors launched the tokens on Nov. 5 and Nov. 7, then used liquidity pools on decentralized exchanges to move value between wallets without direct wallet-to-wallet transfers. One wallet group swapped stolen NEAR tokens into the new memecoins, while another sold the memecoins back into the pools for NEAR. The tokens drew almost no outside trading and were abandoned shortly after launch.

The analytics firm also found that five of the six token creators were funded with proceeds from earlier token sales just two to 13 minutes before the next launch, linking the operations in a chain of transactions. Elliptic said the same layering technique was used after the 2025 Bybit hack, when North Korean-linked actors moved at least $24 million through a newly created token on TRON.

At the time of Elliptic’s analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved, valued at $43.7 million.