Elliptic Exposes North Korea's New Money-Laundering Tactic: Self-Made Meme Coins Used as Transit Points to Move Stolen Binance Funds

Nov. 9 — Blockchain analytics firm Elliptic said in a post that North Korean hackers are using self-made meme coins to launder funds stolen in the Binance hack, creating junk tokens that nobody trades, setting up liquidity pools, and then using different wallets to complete buys and sells so the stolen funds look like legitimate trading proceeds.

Elliptic noted that the technique has appeared successively on the Tron, Solana and NEAR networks. On NEAR, the hackers reportedly created at least six meme coins — FUK, OLCCL, MEILI, MMLI, DABI and SINU — and set up a separate NEAR liquidity pool for each token. The hackers then used one set of wallets to buy the tokens with stolen NEAR, and another set of wallets to sell the tokens and recover the NEAR, thereby severing the direct transfer links between the different wallets. On-chain data shows that the buying wallets for these six tokens were all funded with stolen NEAR, totaling about 117,000 NEAR, worth roughly $430,000 at current prices.

Elliptic stressed that these tokens have virtually no real market demand and that trading activity is mainly carried out by wallets inside the laundering network. Their purpose is not to conceal on-chain funds, but to add extra transaction steps and slow down investigators' tracing.