North Korean Hackers Launder Binance Hack Funds via Fake Meme Coins
North Korean hackers are reportedly using newly created meme coins on the NEAR blockchain to launder cryptocurrency stolen from the massive $6.4 billion Binance hack.
North Korean hackers, identified by the moniker TraderTraitor, are employing a novel laundering technique involving the creation of disposable meme coins on the NEAR blockchain to obscure the origin of funds stolen in the recent $6.4 billion Binance hack. This sophisticated operation aims to transform illicit cryptocurrency gains into seemingly legitimate trading profits by creating artificial liquidity pools and engaging in fake trading activity.
The laundering process begins with the attackers creating a new token using readily available public tools. Subsequently, they establish a liquidity pool, pairing this newly minted token with a legitimate asset like NEAR or a stablecoin. This pool acts as a decentralized exchange mechanism, allowing for the exchange of assets without direct buyer-seller matching. The hackers then utilize one set of their controlled wallets to purchase the new token with the stolen cryptocurrency, while another set of wallets sells tokens into the same pool, withdrawing the genuine asset. This intermediary pool complicates direct tracing, making the funds appear as if they were earned through legitimate token trading.
Researchers from Elliptic identified this activity, noting that between November 5 and November 7, the operators launched six NEAR tokens: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each token launch cost approximately 25 NEAR (around $430,000 USD at the time of reporting). The tokens featured logos mimicking popular meme coin aesthetics, including animal imagery and even an Elon Musk-themed banner, though researchers confirmed no connection to Musk.
This method builds upon similar laundering tactics observed following a previous Bybit hack, where attackers moved at least $24 million in stolen assets using worthless Tron tokens and new wallets. While the Bybit incident involved workstation compromises and malicious transaction alterations, the current Binance-linked activity focuses on post-breach fund movement through decentralized exchanges.
Analysis of the NEAR tokens revealed a consistent pattern: they were launched, experienced heavy trading within hours, and were subsequently abandoned. None of the tokens had seen trading activity since November 8, the date Elliptic published its findings. Furthermore, creators of four of the tokens withdrew the remaining liquidity from their pools on the afternoon of November 9, reinforcing the assessment that these were temporary laundering vehicles rather than genuine projects.
Elliptic's investigation highlighted that wallets controlled by the laundering network accounted for nearly all buying and selling activity across the six tokens. Funding relationships also provided a crucial link, with five token creators receiving funds from wallets that had just sold an earlier token, often within minutes of launching the next. This rapid, interconnected activity points to a coordinated effort.
Despite the obfuscation attempts, the transactions remain traceable on public blockchains. The use of multiple swaps and liquidity pools introduces delays but does not erase the audit trail. This technique buys the operators time before their funds are flagged by financial institutions. Elliptic advises cryptocurrency exchanges and compliance teams to scrutinize newly launched tokens, low-trader volume, segregated buying/selling wallets, and accounts funded immediately before trading activity, as these can be indicators of such laundering schemes.
The $6.4 billion Binance hack, attributed to the North Korean hacking group TraderTraitor, remains one of the largest cryptocurrency thefts on record. This latest laundering technique underscores the evolving sophistication of nation-state-backed cybercriminal operations in their efforts to monetize stolen digital assets.