North Korea Uses Meme Coins to Move Binance Hack Proceeds

WHO:

Elliptic - Elliptic attributed the Binance theft and laundering activity to North Korean hackers, whom it also described as launderers.

Elliptic - The earlier Bybit theft and its laundering were attributed to TraderTraitor.

Techmeme - A Wall Street Journal report said some crypto developers say they cannot stop North Korean hackers from laundering stolen funds through their platforms.

Techmeme - The Wall Street Journal report said THORChain handled about $1 billion in stolen Bybit funds in 2025 and collected more than $12 million in fees; it began moving Binance theft proceeds despite FBI pleas, saying it could not stop the transfers.

Cointelegraph - Elliptic traced the stolen funds through six new tokens on NEAR.

WHAT:

Elliptic - Elliptic described the Binance theft as $6.4 billion; Techmeme and Cointelegraph described it as $6.3 billion. Elliptic called it crypto’s biggest-ever heist through a Techmeme excerpt quoting Bloomberg.

Elliptic - North Korean launderers created at least six meme tokens on NEAR and used liquidity pools to move about 117,000 stolen NEAR, worth around $430,000, between wallets.

Elliptic - The six tokens were FUK, OLCCL, MEILI, MMLI, DABI and SINU. DABI, MMLI and SINU each had one buying wallet and one selling wallet.

Elliptic - The tokens were traded heavily within hours and then abandoned. None had traded since November 8; creators of four tokens withdrew remaining pool liquidity that afternoon.

Elliptic - About 11.8 million NEAR, valued at $43.7 million, from the theft had not yet moved.

Elliptic - The launderers used a worthless token on Tron and a related approach on Solana. On Solana, stolen SOL was swapped into wrapped, thinly traded tokens, sold for USDC and moved to other blockchains.

Elliptic - In the 2025 Bybit laundering, at least $24 million was moved through a worthless Tron token paired with a stablecoin.

Cointelegraph - Hackers used liquidity pools to obscure transfers between wallets.

WHERE:

Elliptic - The reported laundering activity involved the Tron, Solana and NEAR blockchains.

Techmeme - THORChain was identified as a platform that handled stolen funds.

WHEN:

Elliptic - The Binance theft was identified as an October 2026 heist.

Elliptic - A Tron token used in the Binance laundering was identified on November 2; the Solana activity was described as occurring the following day.

Elliptic - The six NEAR tokens were created between November 5 and November 7. FUK was created at 00:25 UTC on November 5; OLCCL, MEILI, MMLI and DABI on November 6 between 07:19 and 14:27 UTC; SINU at 10:06 UTC on November 7.

Elliptic - Each NEAR token cost about 25 NEAR, or around $90, to create. Each was first sold within three hours of launch and did at least three-quarters of its trading within one day.

Elliptic - The Bybit laundering described in the article took place in 2025.

WHY:

Elliptic - The tokens were used to place an obscure asset between wallets holding stolen funds and wallets collecting real assets, slowing investigators’ tracing efforts rather than concealing the transactions.

Elliptic - The tokens were inexpensive to create and could be discarded after use.

HOW:

Elliptic - The launderers created tokens, paired them with NEAR or another real asset in a decentralized-exchange liquidity pool, bought the tokens with stolen funds through one set of wallets, then sold them through another set to collect the real asset.

Elliptic - Five token creators were funded by wallets that had sold an earlier token 2–13 minutes before the new token’s launch; the proceeds helped fund later tokens.

Elliptic - Buying wallets for all six tokens were funded with stolen NEAR. Almost the same amount left collecting wallets soon afterward, often going into stablecoins or a cross-chain bridge.

(UPDATED November 9, 2026 21:08 UTC)

North Korean hackers laundered a record Binance theft, valued at roughly $6.3 billion. They routed stolen funds through disposable tokens on NEAR, obscuring transfers between wallets. The scheme echoes earlier Bybit laundering, while THORChain processed stolen funds despite warnings.