North Korean Hackers Use Meme Coins to Launder Funds from $6.4B Binance Hack

North Korean hackers involved in the $6.4 billion Binance breach are reportedly creating their own meme coins to facilitate the laundering of stolen cryptocurrency. A recent report from blockchain analytics firm Elliptic revealed that at least six tokens were minted on the NEAR Protocol between November 5 and 7, which were used to move around 117,000 NEAR, valued at approximately $430,000.

The attackers developed tokens with minimal market demand and paired them with stolen NEAR in decentralized exchange liquidity pools. This method allowed them to obscure the movement of funds, making it appear as though the transactions were legitimate trading activities. Elliptic noted that five of the tokens were solely purchased by wallets linked to the laundering operation, while external trading accounted for less than 1% of activity in the sixth token.

The six tokens, named FUK, OLCCL, MEILI, MMLI, DABI, and SINU, cost around $90 each to create. Most trading activity ceased shortly after the tokens were launched, with no recorded trades since November 8. Similar laundering techniques were previously observed following the $1.5 billion Bybit hack in 2025.

Elliptic emphasized that while the laundering process adds complexity, the transactions remain traceable on public blockchains. As of the latest analysis, approximately 11.8 million NEAR, worth around $43.7 million, stolen during the Binance attack had not yet moved. The firm cautioned that funds received from liquidity pools should not be automatically deemed legitimate, especially when involving recently created tokens with limited trading activity.

New Developments in the Cupsey Allegations

• Bubblemaps has linked the Solana trader known as Cupsey to approximately $1.74 million extracted through a network of around 30 connected wallets.
• The investigation outlines a four-step operation involving early token purchases, distribution to side wallets, public wallet signaling, and subsequent selling by the side wallets.
• Since May 7, the linked wallets have reportedly traded over 27,000 tokens.
• Additionally, Cupsey is connected to a token deployer that allegedly made $1.3 million through token launches followed by rug pulls.
• Cupsey has reportedly earned $331,000 in rewards from callouts, in addition to the alleged earnings from the side-wallet operation.
• The token associated with Cupsey, $CUPSEY, had a market cap close to $3.7 million in recent assessments.

New Developments on North Korean Hackers

North Korean launderers have minted at least six new tokens on the NEAR blockchain, including FUK, OLCCL, MEILI, MMLI, DABI, and SINU, to launder stolen funds from the $6.34 billion Binance hack attributed to the TraderTraitor group.

Between November 5 and 7, approximately 117,000 NEAR (around $430,000) was processed through these tokens. The laundering technique involves creating a token, opening a liquidity pool, buying the token with stolen funds, and then selling it back into the pool from different wallets, obscuring the direct transfer of stolen funds.

Each of the six tokens cost about 25 NEAR (approximately $90) to create and was heavily traded shortly after their launch but has not traded since November 8. The creators of four tokens withdrew the remaining liquidity on the same day.

Elliptic has tracked over 20,000 wallets across 16 blockchains related to this laundering scheme, with more than 36 services and 65,000 transactions involved. The conversion of stolen assets into bitcoin is a significant aspect of this operation, with about $2.85 billion of the original stolen funds frozen and a negligible amount likely cashed out.

New Facts on North Korean Hackers and Meme Coins

• North Korea-linked hackers are laundering funds from the $6.4 billion Binance hack using TRON, Solana, and NEAR-based memecoins.
• Approximately $430,000 worth of NEAR has been linked to the creation of six animal-themed memecoins, including one promoting Elon Musk as a potential 2028 presidential candidate.
• Crypto security analysts at Elliptic suggest that the memecoins were primarily used for money laundering, as they were traded infrequently and generated profits equivalent to the initial investment.
• The memecoins are inexpensive to produce, costing around $90 per launch, and can complicate tracing efforts for investigators.
• Funding for these memecoins originated from the TraderTraitor hacking group's crypto wallet, which held approximately $43.7 million worth of NEAR tokens.
• Elliptic previously observed TraderTraitor using a similar memecoin laundering strategy following the $1.5 billion Bybit hack, moving at least $24 million through TRON-based memecoins.

New Developments in the Binance Hack Investigation

Circle has announced that it has frozen approximately $1.1 billion in USDC linked to the ongoing investigation of the Binance hack.

The hack reportedly involved more than $6 billion in digital assets, and the investigation is still ongoing.

Circle clarified that freezing funds does not equate to determining asset ownership or guaranteeing recovery for victims, emphasizing the complexities involved in digital finance.

Unlike Bitcoin, USDC can be frozen due to its administratively controlled token system, which raises questions about governance and the process for initiating such freezes.

The investigation highlights the challenges of tracking and recovering funds in a landscape where assets can be rapidly moved across various platforms and token types.

New Developments in the Binance Hack Incident

• On October 29, 2026, approximately $6.3 billion was drained from Binance’s hot wallets, marking it as the largest recorded crypto heist.
• The attack affected hot wallets across multiple blockchains, including Ethereum, Bitcoin, Tron, XRP Ledger, and Solana.
• The exploit targeted Binance’s signing infrastructure, rather than compromising private keys.
• Blockchain analytics firms identified the attackers as TraderTraitor, a group linked to North Korea.
• Binance covered $6 billion of the loss from its reserves and reopened withdrawals by November 1, 2026.
• Stablecoin issuers froze around $3 billion of the affected assets post-attack.
• Debate continues over the idea of implementing a temporary undo button for blockchains, with differing opinions from experts Omid Malekan and Lorenzo Valente.
• The incident has not led to immediate governance changes on major networks, highlighting the ongoing tension between transaction finality and user protection in the crypto space.

New Developments on North Korean Hackers

North Korean hackers involved in the $6.4 billion Binance heist are now laundering stolen crypto assets through newly minted memecoins on the NEAR blockchain. They have created six memecoins, including ones named "FUK" and "SINU," featuring logos of chimpanzees and references to Elon Musk.

The laundering process involves moving stolen NEAR tokens into specific wallets, which are then used to acquire the memecoins from liquidity pools. These tokens are sold back into the liquidity pools to withdraw legitimate crypto assets. The hackers are also employing similar techniques on the Tron (TRX) blockchain and utilizing existing tokens on Solana (SOL).

According to Elliptic's chief scientist, Tom Robinson, the laundering methods are designed to slow down tracking efforts rather than completely hide the funds. Each transaction adds complexity, making it more challenging for authorities to trace the stolen assets.

Chainalysis has linked the hack to the North Korean cybercrime group TraderTraitor, which is believed to operate under the Lazarus Group, a state-sponsored hacking entity.