North Korean Binance Hackers Created Fake Memecoins Including an Elon Musk Token to Launder $430K in Stolen Crypto

North Korean hackers responsible for the $6.3 billion Binance hack used at least six homemade memecoins on the NEAR blockchain to launder approximately $430,000 in stolen funds, according to blockchain analytics firm Elliptic. The tokens, created between November 5 and November 7, included one themed around Elon Musk's likeness alongside several animal-themed coins, all of which were quickly abandoned after serving their purpose.

The scheme exploited decentralized exchange liquidity pools to sever the visible link between wallets holding stolen NEAR tokens and wallets collecting proceeds. One set of wallets purchased the throwaway memecoins using roughly 117,000 stolen NEAR, while a separate set of wallets sold those same tokens into the pool and collected NEAR in return. Because the two groups of wallets never transact directly, the collecting wallets appear to casual observers as ordinary traders who sold a token at a profit. Elliptic noted that much of the NEAR collected was subsequently moved into stablecoins or routed through cross-chain bridges.

Elliptic confirmed this is not a novel tactic for North Korean-linked launderers. The same technique was used following the 2025 Bybit hack, where launderers moved around $24 million through a homemade token paired with a stablecoin on the Tron network. While Elliptic acknowledged the method slows tracing efforts, it said the funds' trail remains visible on-chain.