North Korea is minting meme coins to launder the Binance hack

The cybercriminals are now using meme coins as a laundering mechanism to move stolen funds, the firm said in a November 9 blog post. Elliptic identified six meme coins created between November 5 and November 7, 2026, that were used to route approximately $430,000 worth of stolen NEAR cryptocurrency through liquidity pools on decentralized exchanges. The tokens, named FUK, OLCCL, MEILI, MMLI, DABI and SINU, were paired with NEAR in separate liquidity pools, allowing launderers to buy tokens with stolen NEAR and sell them back to extract clean assets, with no direct transfer between the two groups of wallets. Each token cost about 25 NEAR, or roughly $90, to launch and featured cartoonish artwork including an image of Elon Musk under an "Elon 2028 President" banner, a monkey with a pink bow, and a duck posed against an American flag. Elliptic noted there is no indication that Elon Musk has any connection to the tokens. The trading data shows the tokens served no purpose beyond laundering, with outside traders accounting for less than 1% of one token's volume and trading across all six tokens stopping by November 8. The laundering wallets themselves placed every sell order in all six tokens and every purchase in five of them. The technique is not new; Elliptic first observed it after the $1.5 billion Bybit hack in 2025, when North Korean launderers used a worthless Tron token to move at least $24 million. According to Elliptic's Tom Robinson, the method "slows investigators down rather than hiding the funds" since every step remains visible onchain. The firm cautioned compliance teams not to treat funds coming out of a liquidity pool as clean by default, listing warning signs such as tokens only days old, pools with a handful of traders, and wallets that only buy or only sell. The FBI attributed the October 29 theft to North Korea's TraderTraitor hacking group on October 31, 2026. Binance's own account of the breach, published November 3, 2026, described a months-long intrusion built on fake recruitment interviews and tampered developer software, where malicious code replaced a legitimate development tool without tripping endpoint security, ultimately leading to access to wallet signing operations.