North Korean hackers have found a new use for worthless meme coins to move stolen crypto without directly linking the wallet holding the loot to the wallet receiving it. In the $6.3 billion Binance hack, about $430,000 in stolen NEAR passed through six homemade tokens.
Here’s how the hackers are using this method to launder crypto, a tactic they have also used in the past, including during the Bybit hack.
North Korea Has a New Way to Launder Stolen Crypto
Blockchain analytics firm Elliptic says TraderTraitor, a North Korean hacking group linked to the Lazarus Group, is using short-lived meme coins to move stolen crypto and hide its trail. The group is now using this method to launder part of the $6.3 billion stolen in the Binance hack on October 29, 2026.
North Korea’s launderers are creating their own meme coins to move funds stolen from Binance.
Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went…
— Elliptic (@elliptic) November 9, 2026
Between November 5 and 7, the hackers created six tokens on the NEAR blockchain, including FUK, OLCCL, MEILI, MMLI, DABI and SINU. Creating each token cost just 25 NEAR, or around $90.
They then paired the tokens with NEAR in liquidity pools on a decentralized exchange. Around 117,000 NEAR, worth about $430,000, passed through these tokens. Some of the funds were later converted into stablecoins or moved to other blockchains.
What makes this activity stand out is that almost all trading came from wallets linked to the hackers. Trading also stopped soon after the tokens had served their purpose. This points to the tokens being created specifically to move stolen funds, not to build regular meme coin projects.
North Korea’s Four-Step Meme Coin Strategy
Step 1: Create a worthless token
The hackers create a new meme coin using a public token-creation tool. Each token costs only a small amount of NEAR to launch.
Step 2: Create a liquidity pool
They pair the newly created token with a real cryptocurrency on a decentralized exchange.
Step 3: Trade the stolen crypto through the token
A wallet holding stolen crypto buys the newly created meme token, while another wallet sells it back through the same liquidity pool.
Step 4: Move the recovered funds
The receiving wallet gets the original cryptocurrency back, which can then be swapped into stablecoins or moved across different blockchains.
Why This Strategy Makes Crypto Tracking Harder
The technique does not make the stolen funds invisible. Every transaction remains recorded on-chain, allowing investigators to trace the movement. However, each additional swap creates more work for investigators
North Korea has used a similar approach before. After the 2025 Bybit hack, Elliptic identified at least $24 million moving through a worthless token created on Tron.
Even the Binance case shows how North Korean-linked hackers are using low-cost methods across Tron, Solana, and NEAR to move stolen funds and make investigations harder.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
