Hackers linked to North Korea are using their own memecoins to conceal the movement of crypto assets stolen from Binance. Analytics company Elliptic has tracked around 117,000 NEAR tokens worth approximately $430,000, which passed through six newly created memecoins between November 5 and 7.
The tokens were created for one-time use and were traded mainly by wallets linked to the operation. One of them used an image of Elon Musk with the caption „Elon 2028 President“. Elliptic stressed that there is no evidence that the billionaire was involved in creating the coin.
How the scheme works
The operation uses liquidity pools on decentralized crypto exchanges. First, one group of wallets exchanges the stolen cryptocurrency for a newly created memecoin. Then another group sells the tokens back through the same pool and receives real crypto assets.
Thus, an intermediary asset appears between the wallet holding the stolen funds and the wallet receiving them. At first glance, the transactions may look like ordinary trading in a new token rather than a direct transfer of the stolen cryptocurrency.
„The hackers are using tokens that nobody wants to buy to conceal the movement of the stolen funds“, Elliptic said.However, all operations remain recorded on the blockchain. According to Elliptic, the scheme does not erase the trail but slows the investigation, as each additional exchange requires a new analysis of wallets, tokens and transactions.
Six tokens and a short life cycle
Creating each of the six tokens cost around 25 NEAR, or approximately $90. The tokens were traded heavily during the first few hours and then abandoned. None of them was traded after November 8, while the creators of four of them withdrew the remaining liquidity from the pools.
Elliptic found that around 11.8 million NEAR worth $43.7 million of the funds stolen in the attack on Binance have still not been moved. The tracked 117,000 NEAR were sent to other wallets, with a significant portion subsequently converted into stablecoins or transferred through a cross-chain bridge.
Similarity to the Bybit theft
This is not the first use of such a technique. In 2025, a group linked to North Korea stole $1.5 billion from the crypto exchange Bybit. Elliptic later found that at least $24 million of that amount had been moved through memecoins.
The attack on Binance was carried out on October 29. Binance initially estimated the value of the stolen assets at around $6.34 billion, while Elliptic rounded the amount up to $6.4 billion. The exchange said it would cover customers’ losses with funds from the SAFU fund and its own resources. As of October 31, the company reported that 98% of the lost assets had been returned or recovered.
Sources: mezha.ua