Key Takeaways

• Linked wallets controlled nearly all trading in the disposable tokens.

• Launderers recycled sale proceeds to finance new token launches.

• Stolen assets converted into bitcoin reached about $225 million.

Meme Coins Complicate the Binance Hack Trail

North Korean launderers used meme coins and obscure tokens on Tron, Solana, and Near, Elliptic co-founder and chief scientist Tom Robinson explained on Nov. 9. Tron and Near involved newly created coins; Solana relied on existing assets.

Robinson wrote:

“Most people think of meme tokens as joke coins whose prices rise and fall on hype. North Korea’s launderers have found a different use for them, creating tokens that nobody else wants to buy and using them to disguise the movement of stolen funds.”

On Near, one group bought the new coins with stolen cryptocurrency through token liquidity pools. Other wallets sold into the same pools and collected nearly matching proceeds, separating the sending and receiving addresses.

Six tokens created between Nov. 5 and Nov. 7 handled about 117,000 NEAR ($430,000), with almost no outside trading. Each launch cost about $90. Five creators received funding from earlier token sales shortly before launching replacements.

이미지 불러오는 중North Korea's $6.3B Binance Hack Takes a Strange Turn With Meme Coins

Trading bursts preceded inactivity; red crosses mark withdrawals from four pools on Nov. 8. Source: Elliptic.

The Federal Bureau of Investigation (FBI) attributed last month’s Binance theft to North Korea on Oct. 31, identifying the operation as Tradertraitor, a state-sponsored North Korean group targeting cryptocurrency businesses.

However, North Korea denied responsibility for the hack on Nov. 3. Kim Yo-jong, sister of North Korean leader Kim Jong Un, called the FBI’s accusations a “grave political provocation” intended to damage the country’s reputation.

Binance Theft Triggered a Race Against Freezes

Stolen assets from the Oct. 29 Binance attack mixed with proceeds from September’s Bitget theft, Chainalysis found. The firm cited this overlap in attributing the Binance theft to Tradertraitor. Its assessment drew on blockchain activity observed in the hours after the attack.

The attacker attempted to evade freezes through rapid stablecoin conversions, exchanging $325 million in funds for approximately $285 million in ether over nearly 20 minutes. Ether lacks the issuer-controlled freezes available for those stablecoins.

Elliptic flagged a worthless Tron token created solely for laundering on Nov. 2, and stolen solana moved through thinly traded tokens the next day. Elliptic previously traced at least $24 million through a similar scheme after the 2025 Bybit theft.

Explaining the layered approach, Robinson stated:

“North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay. Homemade meme tokens are simply one more layer.”

Thousands of Wallets Lead Into Bitcoin

By Nov. 2, stolen assets had passed through approximately 12,000 wallets across 11 blockchains. Fixed timing and blind retries of failed operations without adjustment indicated conventional automation. Elliptic found no evidence of AI-directed decisions.

A Nov. 7 update counted more than 20,000 wallets, 16 blockchains, and at least 65,000 transactions. Elliptic tracked conversions into approximately 2,300 bitcoin, worth $175 million then, from assets including solana, XRP, and tron.

Converted proceeds reached about 3,000 bitcoin, worth $225 million by Nov. 9. Elliptic also traced roughly 7,000 ether (about $15 million worth) into Tornado Cash, a mixer allowing pooled deposits to be withdrawn to different addresses. The firm estimated that only a negligible amount had likely been cashed out.

On exposure through trading pools, the Elliptic chief scientist warned:

“A wallet that received its funds from a liquidity pool should not be treated as clean by default, as it may sit just two swaps away from stolen funds.”