North Korean hackers have set up a complex laundering scheme using disposable meme coins to clean proceeds from the recent $6.4 billion Binance hack. The method relies on faking trading activity so stolen crypto looks like it came from legitimate investments.
The attack follows the October 29, 2026 breach attributed to the hacking group named TraderTraitor. After the Binance funds were stolen, the criminals worked through new tokens on blockchains like NEAR, Solana, and Tron to move portions of the loot. Roughly 117,000 NEAR — worth about $430,000 — was moved through six recently minted tokens. Analysts from Elliptic uncovered the operation in a report released on November 9. These tokens had names like FUK, OLCCL, MEILI, MMLI, DABI, and SINU.
How the Laundering Mechanism Works
The hackers create a new token using public tools, then pair it in a liquidity pool with a real cryptocurrency or stablecoin. One group of wallets, controlled by the attackers, brings in stolen assets to buy the new token, while another group sells the token in that same pool, pulling out the genuine crypto. Because everything goes through the pool instead of directly from stolen wallet to collector, the trail gets complicated.
Each token created costs about 25 NEAR (~$90) to launch. The scheme unfolds rapidly — tokens are released, traded intensely for a few hours, then abandoned. After November 7, none of the six tokens had trading activity. On the same day as Elliptic’s report, operators withdrew liquidity from four of the pools, suggesting these tokens existed purely for laundering, not legitimate trading projects.
Tracking & Red Flags
Blockchain analysis revealed that wallets tied to the laundering accounted for virtually all token sales, and in many cases bought all of the tokens themselves. Only one token (FUK) had any external buyers—and even those were negligible. Moreover, funding links show creators of newer tokens were paid from wallets that sold earlier tokens just minutes beforehand.
The majority of the real crypto pulled out from the pools was converted into stablecoins or moved across chains through bridges. While these tactics add complexity, the transactions remain on public blockchains — meaning the operations are possible to trace. Investigators warn that withdrawals from liquidity pools shouldn’t automatically be treated as legitimate. Newly launched tokens, unusual patterns of wallet behavior, and immediate pre-funding before trading are indicators that warrant deeper scrutiny.
Exact times of token creation were documented: FUK on November 5 at 00:25 UTC; OLCCL, MEILI, MMLI, and DABI on November 6 between 07:19 and 14:27 UTC; and SINU on November 7 at 10:06 UTC.
This laundering model builds on earlier techniques seen after the Bybit theft, where worthless tokens were used alongside fresh wallets to move roughly $24 million in stolen assets. In both cases, attackers use temporary tokens, liquidity pools, and time gaps to obscure the origin of funds.
What this reveals is a growing sophistication in how state-backed or affiliated hacking groups convert stolen crypto into usable assets. Victims are often unaware until law enforcement or compliance teams trace the money flow and freeze assets. As regulatory frameworks and crypto compliance tools catch up, using detailed blockchain signals may be the key to disrupting similar schemes.
