North Korea's launderers have found a novel use for the internet's favorite joke tokens: washing a slice of the record $6.4 billion stolen from Binance.

Rather than moving funds directly from thief to recipient, the groups are minting home-made meme coins and swapping stolen assets through decentralized-exchange liquidity pools, according to a report from blockchain analytics firm Elliptic. The technique breaks the direct onchain link between the thief's wallet and the one collecting the proceeds. It also shows how laundering is adapting to the structure of decentralized finance itself, where minting a token and seeding a trading pool are open to anyone by design.

How the scheme works

The launderers mint a brand-new token and pair it with a real asset such as NEAR or a stablecoin in a liquidity pool. They pay stolen funds into the pool through one set of wallets to buy the token, then sell it back through a separate set of wallets to withdraw clean-looking assets.

Because the pool sits in the middle, no stolen funds move directly from the buying wallet to the collecting one, and the receiving wallets look like ordinary traders cashing out of a meme coin. That disguise is easier to pull off in meme-coin markets, where rapid bursts of trading around freshly launched tokens are a routine sight rather than a red flag.

Elliptic, in research credited to co-founder Tom Robinson, said the launderers deployed the tactic on Tron and Near, with a close variant observed on Solana.

Six disposable tokens on Near

The clearest example came on Near. Between Nov. 5 and Nov. 7, the launderers created at least six home-made tokens, each paired with NEAR in its own pool. The coins carried the usual meme-coin trappings: cartoon logos of a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. One even featured an "Elon 2028 President" image of Elon Musk, who has no connection to the tokens. The names ran from the crude (FUK) to a riff on dog coins (SINU).

Each token cost about 25 NEAR—roughly $90—to create, a measure of how little friction permissionless chains put in the way of spinning up a branded token. All six followed the same arc: launched, traded heavily within hours using stolen NEAR, then abandoned, with the leftover liquidity pulled from the pools on Nov. 8.

In total, about 117,000 NEAR, or roughly $430,000, passed through the six tokens before much of it flowed onward into stablecoins or a cross-chain bridge.

Traceable, but slower

The sums are modest so far, a reminder that the bulk of the haul is still parked onchain. Elliptic earlier determined that more than $3 billion of the stolen crypto had yet to be laundered, and that the launderers were spinning up a new wallet roughly every 25 seconds to move funds at machine speed.

Crucially, the meme-coin trick does not actually hide the money. Elliptic stressed that the trail remains fully traceable onchain; the maneuver only slows investigators down, buying time in what is essentially a race to move funds before they get flagged. It is one cheap, disposable layer among many that North Korea's launderers stack together.

Elliptic first observed the tactic last year while tracing the $1.5 billion Bybit theft, which was also attributed to the TraderTraitor group behind the Binance breach.

For compliance teams, the firm warned that funds arriving from a liquidity pool should not be assumed clean, especially where freshly minted tokens and a small handful of trading wallets are involved. With the bulk of the record haul still to be moved, that warning effectively hands exchanges and screening teams a concrete pattern to watch for: deposits that trace back to recently created tokens and a narrow cluster of trading wallets.