North Korea Is Using Elon Musk-Themed Memecoins to Launder Crypto From the Binance Hack

After hacking Binance for $6.3 billion late last month, the North Korea-associated hacking group allegedly behind the theft, TraderTraitor, has been using a variety of methods to launder the stolen crypto. In a new report published Monday morning, blockchain analysis firm Elliptic laid out how one of the group’s latest tactics is to create memecoins and move illicit funds through them. According to the report, the launderers create a new token and pair it with another crypto asset, such as NEAR or a stablecoin, in a liquidity pool on a decentralized exchange. One set of wallets buys the token with stolen funds, and a separate set of wallets, also controlled by the launderers, later sells the token back into the same pool and withdraws the paired crypto asset. Because the liquidity pool sits between the crypto transfers, no funds move directly from the buying wallets to the selling wallets, which end up looking like ordinary traders who sold a token at a profit. In the report, Elliptic co-founder Tom Robinson explained, “The launderers’ tokens are made to be used once and thrown away. Nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set.” The clearest example so far has come on the NEAR blockchain, a smart contract platform that markets itself as infrastructure for AI agents. There, the launderers created at least six tokens over three days late last week. The tokens, with names such as FUK, MEILI, and SINU, cost about $90 apiece to create and came dressed in classic memecoin branding, including a monkey wearing a pink bow and an image of Elon Musk under an “Elon 2028 President” banner. About 117,000 NEAR (currently worth around $430,000) in stolen funds passed through the six tokens. The coins are a disguise: a baby monkey, a duck, a mock Elon campaign poster. They make stolen funds look like trading profit – but every step is on-chain, and we traced it. Full analysis:https://t.co/Lw82bKPjwE — Tom Robinson (@tomrobin) November 9, 2026 Within days of the theft, Elliptic also identified a homemade token on Tron that had been created solely to launder funds. On Solana, the launderers took a slightly different approach, swapping stolen SOL, Solana’s native crypto asset, into existing, thinly traded tokens rather than making their own. Elliptic pointed to several signs that the NEAR-based tokens existed only for laundering. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them, with outside activity limited to a few small purchases of FUK on its first day. Five of the six token creators were funded by a wallet that had been selling an earlier token minutes before the new one launched, so the proceeds of one token paid for the next. Each token also did at least three-quarters of its trading within a single day, and none of the six has traded since Sunday. To be clear, the memecoins account for a tiny fraction of the total crypto stolen from Binance, as the roughly $430,000 that moved through the NEAR tokens amounts to less than 0.01% of the $6.3 billion associated with the hack. Notably, this isn’t the first time North Korea has used memecoins for crypto laundering purposes. Elliptic said it first spotted the technique in the laundering of funds from the $1.4 billion Bybit hack in February 2025, when at least $24 million moved through a worthless token on Tron. Memecoins were far more popular at the time, which may explain how tens of millions of dollars were moved through this strategy back then. President Donald Trump had launched his own TRUMP memecoin just a month earlier, a moment CoinGecko co-founder Bobby Ong later said “marked the top for meme coins.” According to Elliptic, “Every step of this technique is recorded publicly on the blockchain, and investigators can follow it. It does not hide the funds so much as slow down the people tracing them.” A Variety of Crypto Laundering Techniques Of course, the memecoins aren’t the only way TraderTraitor is moving funds around. “North Korea’s launderers rarely rely on a single technique,” Elliptic’s report states. “Instead, they layer many cheap techniques, each adding a little more delay.” Elliptic says TraderTraitor’s broader laundering effort has involved more than 20,000 wallets on 16 blockchains and at least 36 services, including cross-chain bridges, lending vaults, and the Privacy Cash privacy pool. Roughly 7,000 ether (ETH), worth about $15 million, has also gone into Tornado Cash since yesterday. Cross-chain exchange THORChain, which has repeatedly been used by North Korea-connected groups after large hacks and has faced accusations of using decentralization theater to avoid culpability, has once again played a central role. Roughly $1.2 billion of the Bybit proceeds were tracked through the protocol into bitcoin. This time, Elliptic says about 12,200 ETH ($29 million), mostly from sales of stolen SOL, had passed through THORChain into bitcoin by Wednesday evening, and much of the stolen XRP has followed. "This is not regulators anymore." 🚨@tayvano_ on why the FBI's North Korea attribution raises the stakes for @THORChain node operators, with @kain and @WormholeOracle on Uneasy Money. pic.twitter.com/Ru0RbMU8Ji — Laura Shin (@laurashin) November 6, 2026 The eventual destination for the crypto laundering efforts does appear to be bitcoin. Elliptic says about 3,000 bitcoin (BTC) ($225 million) converted from other stolen assets now sits in new bitcoin addresses, and around 130 BTC ($10 million) has gone through Wasabi-style CoinJoin transactions, which combine many users’ bitcoin in one transaction to break the link between inputs and outputs. Based on the Bybit case, the firm expects the ETH to be swapped for bitcoin and cashed out through over-the-counter brokers over a period of months. Of course, not all of the crypto stolen from Binance was available to launder. TraderTraitor almost immediately lost access to roughly $3 billion of the crypto it allegedly stole, as Tether, Circle, and other entities quickly froze assets associated with the theft. Tether, for example, froze the stolen USDT on Ethereum just 37 minutes after it arrived in the attacker’s wallet, according to Elliptic. That response drew some criticism as an example of how the crypto industry often relies on the same sort of centralized controls found in traditional banking. The Memecoin Playbook Memecoins are something of an extension of the NFT craze from the 2021 crypto cycle, letting celebrities and content creators spin up tokens built around their own personas. Their charts almost always look like pump-and-dump schemes shortly after launch, and famous names are often used to bring in buyers for early insiders to dump on. In January, former New York City Mayor Eric Adams was accused of a pump-and-dump after his NYC Token jumped from about $0.12 to nearly $0.60 and then fell below its starting price in a little over an hour. Before that, Haliey Welch, better known as the “Hawk Tuah girl,” saw her HAWK token hit a $490 million market cap and then plunge more than 90% within hours of its December 2024 launch. More recently, Hunter Biden launched his LAPTOP memecoin in September after a months-long media tour of podcasts and other online shows. The token briefly spiked to a fully diluted valuation above $100 billion before losing about 98% of that paper value, and blockchain analytics provider Bubblemaps found that 80% of traders lost money. It was all fairly predictable, as there were plenty of signs this was coming months before the eventual token launch. It’s hard to think of a better summary of the crypto industry’s current state than North Korean hackers using memecoins to launder the proceeds of the largest crypto theft on record. For all the talk of revolutionizing and democratizing finance, the main use cases for crypto beyond Bitcoin’s store of value still appear to be the crypto token casino and sidestepping the regulations that govern traditional banking.