North Korean hackers created memecoins to launder cryptocurrency stolen in the $6.3 billion Binance hack, routing roughly $430,000 through six newly launched tokens on the NEAR blockchain, according to a report from blockchain analytics firm Elliptic.

Between Nov. 5 and 7, the hackers deployed at least six tokens on NEAR and used liquidity pools on decentralized exchanges to move stolen funds between wallets, Elliptic said. The tokens attracted almost no trading from outside users and were abandoned shortly after launch.

The laundering scheme relied on two separate sets of wallets. One set swapped stolen NEAR tokens for the newly created memecoins, while a second set sold those memecoins back into the liquidity pools in exchange for NEAR. The technique allowed the hackers to move funds without direct wallet-to-wallet transfers, although every transaction remained traceable onchain. On smart-contract platforms like NEAR, creating a token and seeding its liquidity pool is a low-cost operation, which is why a freshly launched memecoin can serve as a cheap extra layer of separation between stolen funds and their origin even as each step stays publicly visible.

Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales just two to 13 minutes before the next launch, linking the tokens in a chain of transactions. Like other blockchain analytics firms, Elliptic traces illicit fund flows across public ledgers to help exchanges and authorities identify and freeze stolen assets. The episode fits a longer pattern: analytics firms have for years identified North Korea-linked groups as the most prolific source of cryptocurrency theft, and proceeds tied to the country are subject to international sanctions.

"North Korea's launderers rarely rely on a single technique," Elliptic co-founder Tom Robinson wrote in the report. "Instead, they layer many cheap techniques, each adding a little more delay."

According to Elliptic, the same laundering technique was used following the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain. That breach is widely regarded as the largest cryptocurrency hack on record.

At the time of Elliptic's analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved, which the firm valued at $43.7 million. Those funds still sit at addresses visible to anyone on the public ledger, so any future movement can be monitored in real time — the same transparency that allowed Elliptic to reconstruct the memecoin chain in the first place.