North Korean launderers are minting their own worthless meme coins and routing stolen Binance funds through them, ensuring the assets never move directly from one wallet to another, blockchain analytics firm Elliptic reported Monday.

Between Nov. 5 and Nov. 7, the operators created at least six new tokens on the NEAR blockchain — FUK, OLCCL, MEILI, MMLI, DABI and SINU — paired each with NEAR in a dedicated liquidity pool, bought the tokens with stolen NEAR from one set of wallets, and sold them back out through a second set. Roughly 117,000 NEAR, or about $430,000, passed through the six tokens, Elliptic wrote.

The scheme is one thread inside the far broader laundering of the Oct. 29 Binance theft, which the exchange has valued at $6.34 billion and which the FBI has attributed to North Korea's TraderTraitor group. Set against that total, the roughly $430,000 that moved through the six tokens is a sliver — but it illustrates the broader operation's defining style: value pushed forward in many small, disposable hops rather than single large transfers. Elliptic's wider update now puts roughly 3,000 BTC — about $225 million — in new bitcoin addresses converted from other stolen assets, while around 11.8 million NEAR, or $43.7 million, from the theft has still not moved.

"Most people think of meme tokens as joke coins whose prices rise and fall on hype," wrote Dr. Tom Robinson, Elliptic's co-founder and chief scientist. "North Korea's launderers have found a different use for them."

How the homemade token trick works

The technique is a four-step hop. The launderers create a token with a public launch tool, open a liquidity pool pairing it with a real asset such as NEAR or a stablecoin, buy the token with stolen funds held in one set of wallets, then sell it back into the same pool from a second set of wallets that collect the real asset.

At no point do the stolen funds transfer directly from a buying wallet to a collecting wallet, because the pool sits in between. To a casual observer, the collecting wallets look like ordinary traders who sold a token at a profit. In practice, each token works as a one-way tunnel: created for a single laundering pass and then abandoned, rather than maintained as a functioning market.

Each of the six NEAR tokens cost about 25 NEAR — roughly $90 — to create. All were traded heavily within hours using stolen NEAR and then abandoned. None has traded since Nov. 8, and that afternoon the creators of four of them withdrew what liquidity was left. The tokens also form a chain: five of the six creators were funded by a wallet that had just sold an earlier token, between two and 13 minutes before the next launch.

Elliptic first reported the same approach in the laundering of the February 2025 Bybit theft, also attributed to TraderTraitor, when a worthless Tron token helped move at least $24 million. In the Binance case, the firm has also observed the technique on Tron, along with a close variant on Solana that used existing thinly traded tokens rather than homemade ones.

A slowing tactic, not a disappearing act

The meme coins do not hide the funds — every step is public on-chain. What they buy is time. Each additional hop slows investigators while launderers race to move money before it is flagged, and at about $90 apiece the tokens are cheap enough to throw away.

The tactic fits the larger pattern Elliptic has tracked since the theft: more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. Binance has said the attack began with a fake job interview and ran for five months before any coins moved, and blockchain firms linked the breach to TraderTraitor within a day.

The conversion into bitcoin is the bigger dollar story. All of the stolen SOL has already been swapped, bridged or mixed, and much of the XRP route has fed into bitcoin as well. About $2.85 billion of the original haul has been frozen, while a negligible amount has likely been cashed out so far, Elliptic said.

North Korea's crypto theft machine is not new. Elliptic put the regime's 2025 haul above $2 billion, driven by the $1.46 billion Bybit exploit, and its cumulative known total above $6 billion even before the Binance incident.

Binance has reopened withdrawals in stages and said it covered customer losses from its own funds. For investigators, the test now is whether homemade liquidity pools keep multiplying faster than the blocklists catching up to them — and how the NEAR that has yet to move is eventually worked through.

This article was originally published on Bitcoin Magazine and is written by Micah Zimmerman.