North Korean hackers have created their own memecoins to launder funds stolen in the $6.3 billion Binance hack, using simulated trading activity to make illicit proceeds appear as legitimate trading profit.

According to an analysis by blockchain analytics firm Elliptic, the hackers moved approximately 117,000 $NEAR tokens — worth roughly $430,000 — through six memecoins created between Nov. 5 and Nov. 7.

One of the tokens featured an image of Elon Musk beneath an "Elon 2028 President" banner, though Elliptic said there is no suggestion that Musk is connected to the tokens. Their names followed familiar memecoin conventions, including a crude joke and the "inu" suffix commonly used in dog-themed memecoins — details that helped the tokens pass for ordinary memecoin launches.

The scheme worked by pairing each memecoin with $NEAR in its own liquidity pool on a decentralized exchange. The hackers then used one set of wallets to buy the memecoins with stolen $NEAR, and a separate set of wallets to sell those same memecoins back for $NEAR. As a result, funds never passed directly from one wallet to another, making the money appear to be the product of profitable trading rather than the hack. The distinction matters for investigators, whose tracing techniques typically follow direct transfers between addresses — a path this method deliberately avoids.

"The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds," Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.

Elliptic found that almost all trading came from wallets tied to the laundering operation, with outside buyers accounting for less than 1% of one token's volume. Trading across all six tokens stopped by Nov. 8.

The FBI has attributed the Oct. 29 Binance theft to North Korea's TraderTraitor group. The hackers have also used THORChain to convert stolen assets into bitcoin, which cannot be frozen by a central issuer, making the memecoin pools one step in a longer laundering chain. The roughly $430,000 routed through the six tokens is a small fraction of the $6.3 billion taken.

Elliptic identified a similar memecoin-based laundering method following the 2025 Bybit hack, and said the new trades complicate efforts to trace the stolen funds but do not erase their trail. With the method now documented across two major exchange thefts and the trail intact, the laundering pattern itself — self-created tokens, self-directed trading, and clustered wallets — offers investigators additional markers in the effort to trace where the stolen funds travel.