Elliptic reveals North Korea meme coin laundering on Binance
North Korean state-sponsored launderers have developed a novel method to move illicit funds stolen from the Binance cryptocurrency exchange, according to a report published Monday by blockchain analytics firm Elliptic. The operatives are creating and deploying their own disposable meme coins on the NEAR Protocol blockchain to obfuscate the trail of stolen crypto.
This sophisticated new tactic was used to launder approximately 117,000 NEAR tokens, valued at around $430,000, between November 5 and November 7, 2026.
North Korea meme coin laundering on NEAR Protocol
This particular operation represents a relatively small sum compared to the estimated $6.3 billion taken from Binance in the massive October 29, 2026, hack, which the FBI has attributed to North Korea’s notorious TraderTraitor hacking group.
However, the emergence of this technique signals a continued evolution in the methods used by Pyongyang to circumvent transaction monitoring and fund its illicit weapons programs, posing ongoing challenges for cybersecurity and compliance teams globally.
Elliptic’s investigation detailed how the North Korean launderers established six distinct meme tokens—FUK, OLCCL, MEILI, MMLI, DABI, and SINU—each costing about 25 NEAR, or roughly $90, to launch.
These tokens, adorned with cartoonish imagery ranging from a monkey in a pink bow to Elon Musk under an “Elon 2028 President” banner, served no legitimate trading purpose. Their sole function was to act as a temporary intermediary for moving stolen NEAR.
The process involved creating a liquidity pool for each meme coin, pairing it with NEAR, the native token of the NEAR Protocol. One set of wallets deposited stolen NEAR into these pools to acquire the newly minted meme tokens.
Almost immediately, a separate group of wallets would sell these meme tokens back into the pool, withdrawing the original NEAR. This effectively creates a disconnected transaction, making it harder for blockchain analytics software to directly link the origin of the stolen funds to their ultimate destination.
The mechanics of meme coin obfuscation
The core of this laundering strategy lies in leveraging decentralized exchange (DEX) liquidity pools. By inserting these disposable tokens and their pools between the initial stolen funds and subsequent wallets, the launderers create an additional layer of complexity.
As Elliptic noted, “They exist only to put a pool between the stolen funds and the next wallet.” This creates a broken chain of direct transfers, slowing down forensic analysis.
Blockchain data revealed a clear pattern of orchestrated activity. The laundering wallets were almost exclusively responsible for every sell order across all six tokens and nearly every purchase. Outside traders were conspicuously absent, confirming the tokens’ purpose was purely for money laundering.
This specific activity took place over a concentrated three-day period, after which trading ceased for all six tokens by November 8, with four creators subsequently draining their respective liquidity pools.
Disposable assets for illicit gain
The fleeting nature of these meme coins highlights their disposable design. In five of the six instances, the wallet funding a new token’s creation had just minutes earlier—between two and 13 minutes—been used to dump the prior token.
This chained financing demonstrates a systematic approach, with profits from one laundering cycle directly funding the launch of the next. Such rapid deployment and decommissioning further complicate efforts to track the funds over time.
Beyond the operational mechanics, the choice of meme coins themselves is strategic. Their inherent lack of utility and often whimsical nature can sometimes mask the serious intent behind their creation. While these specific tokens featured irreverent artwork, Elliptic found no suggestion that figures depicted, like Elon Musk, had any connection to the illicit activity.
This underscores the purely functional role these tokens played in the laundering process.
Echoes of past exploits: Bybit and Solana connections
This tactic, while newly prominent in the Binance case, is not entirely unprecedented. Elliptic first observed a similar methodology following the 2025 Bybit exchange breach, which saw a loss of approximately $1.5 billion. In that incident, launderers utilized a worthless Tron token to move at least $24 million. This demonstrated an earlier iteration of using temporary, low-value assets for large-scale fund movement.
In the lead-up to the current NEAR Protocol scheme, other preparatory moves were detected. A similar Tron token surfaced on November 2, followed a day later by stolen SOL, the native token of the Solana blockchain, being routed through existing but thinly traded Solana tokens.
This suggests a pattern of experimentation and refinement by the North Korean operatives, progressively adapting their techniques across different blockchain ecosystems. These smaller-scale movements may serve as testing grounds for more substantial laundering operations.
North Korea’s growing crypto theft empire
The use of meme coins for laundering is just the latest innovation in North Korea’s extensive and sophisticated cybercrime operations. The nation, primarily through groups like Lazarus Group, also known as TraderTraitor, has become a leading perpetrator of cryptocurrency theft globally.
Since 2017, North Korean-backed hackers have stolen an estimated $12.8 billion in crypto across hundreds of incidents. A staggering $7.4 billion of that total occurred in 2026 alone, largely dominated by the massive Binance theft.
In 2025, North Korean hackers stole at least $2.02 billion in cryptocurrency, marking a 51% year-over-year increase. Their all-time total reached $6.75 billion by the end of 2025, a figure that has now nearly doubled.
Major past incidents include the $620 million Ronin Network hack in March 2022 and the $100 million Harmony Horizon bridge theft in June 2022. These attacks demonstrate a consistent targeting of various crypto platforms and protocols.
Funding illicit weapons programs
The proceeds from these large-scale cyber thefts are not merely for personal enrichment; they are a critical source of revenue for North Korea’s nuclear and ballistic missile programs. Faced with stringent international sanctions, Pyongyang has increasingly turned to the relatively unregulated crypto landscape to generate foreign currency and circumvent financial restrictions.
A UN panel of experts reported in spring 2024 that it was reviewing 58 suspected cyber-attacks by North Korea on cryptocurrency companies between 2017 and 2023, worth $3 billion, estimating this cash generated half of North Korea’s foreign currency income.
This direct link between crypto theft and national security programs elevates these incidents beyond mere financial crime. It transforms them into matters of international security, driving urgent calls for enhanced global cooperation and more robust enforcement mechanisms within the cryptocurrency industry. The sheer volume of funds acquired through these illicit means underscores the strategic importance of cyber operations to the North Korean regime.
Challenges for blockchain forensics and compliance
While the meme coin technique creates layers of obfuscation, Elliptic’s Tom Robinson noted in the firm’s report that “the technique slows investigators down rather than hiding the funds.”
Every step of these transactions remains visible on-chain, but the sheer volume of data and the intentional creation of indirect pathways require more extensive and time-consuming analysis from firms like Elliptic, Chainalysis, and TRM Labs. These analytics providers are in a constant race to develop tools that can keep pace with evolving laundering methods.
In response to this growing threat, Elliptic has advised compliance teams within financial institutions and crypto businesses not to automatically treat funds emerging from a liquidity pool as clean. The firm highlighted several warning signs, including tokens that are only days old, pools with minimal traders, and wallets that exclusively buy or exclusively sell.
These red flags are crucial for identifying potentially illicit activities and implementing appropriate risk mitigation strategies.
The evolving threat landscape for DeFi
The embrace of disposable meme coins by state-sponsored actors like North Korea highlights the persistent vulnerabilities and unique challenges within the decentralized finance (DeFi) ecosystem. DeFi platforms, by their nature, are designed for permissionless interaction and often lack the centralized controls present in traditional financial systems or even centralized cryptocurrency exchanges. This environment, while fostering innovation, also creates avenues for illicit actors to exploit.
Regulators and law enforcement agencies face a daunting task in keeping up with the rapid pace of innovation and the sophisticated evasion tactics employed by groups like TraderTraitor. The need for stronger anti-money laundering (AML) and combating the financing of terrorism (CFT) controls across DeFi protocols is becoming increasingly urgent.
As the crypto industry continues to mature, its ability to address these systemic risks will be paramount in establishing its legitimacy and ensuring its long-term stability.