North Korean hackers who stole trillions of won in digital assets from Binance, the world’s largest cryptocurrency exchange, resorted to issuing disposable meme coins to bypass digital asset tracking.
Investigations revealed that the cybercriminals created nearly worthless meme coins themselves and executed complex transaction trails to obscure the origins of the stolen funds. According to a report released on September 9 by global blockchain analytics firm Elliptic, the hackers minted six new meme coins on the NEAR blockchain network immediately after the breach to facilitate money laundering.
Meme Coins Used to Mask Illicit Crypto Transfers
The newly minted tokens included FUK, OLCCL, MEILI, MMLI, DABI, and SINU, with an identified laundering scale of approximately $430,000 (about 580 million KRW). The hackers used stolen NEAR tokens from Binance to purchase these newly created meme coins on decentralized exchanges (DEXs).
They then funneled the assets back through wallets with no prior transaction history that bought up the tokens. Through this method, transaction logs made it appear as though the wallet owners were ordinary retail investors profiting from meme coin trades rather than hackers holding illicit funds.
The meme coins featured imagery such as monkeys wearing pink ribbons and Tesla CEO Elon Musk’s face alongside the phrase ‘Elon 2028 President.’ However, Elliptic noted no evidence suggesting that Elon Musk was involved with the tokens. The issued coins were traded for a few hours and then largely abandoned.
Massive Scale and Sophisticated Laundering Techniques
Tom Robinson, co-founder and chief scientist at Elliptic, explained that thousands of meme coins are issued daily, with most disappearing within days, meaning a short-lived token rarely attracts scrutiny. Consequently, wallets carrying meme coin transaction records resemble speculative investor portfolios rather than money laundering operations unless specifically audited.
This tactic was previously deployed during the Bybit cryptocurrency exchange hack last year, also attributed to North Korean hackers, who laundered at least $24 million through meme coins. The Binance breach similarly demonstrated rapid and massive money laundering operations, with Elliptic reporting that over 20,000 wallets and 65,000 transactions were mobilized within a week of the hack.
This translated to a new wallet being deployed roughly every 30 seconds and a transaction occurring every 10 seconds. The hackers also leveraged privacy-enhancing services like THORChain, Privacy Cash, and Wasabi Wallet to complicate transaction tracking.
Asset Freezes and Ongoing Investigations
Elliptic stated that approximately $3.13 billion of the stolen assets remain in hack-associated wallets. Meanwhile, Binance Co-CEO Richard Teng explained that an additional $2.85 billion of the stolen funds had been frozen or blocked from moving.
While stablecoin issuers like Tether and Circle can freeze tokens when necessary, foundational cryptocurrencies like Bitcoin and Ethereum lack central issuers capable of arbitrary freezes. U.S. authorities have identified the North Korean hacking collective TraderTraitor as the mastermind behind the Binance breach, as prosecutors track how the hackers convert stolen funds into Bitcoin and Ethereum across numerous wallets and blockchains.
