North Korea backed hackers have created Elon Musk themed memecoins to launder stolen crypto in the $6.4 billion Binance hack. The hackers are using fake trading activity to disguise the movement of stolen funds.
One of the tokens featured Musk beneath an “Elon 2028 President” banner. Five others carried cartoon animals, crude jokes and familiar dog-coin branding. All six were created within three days and quickly abandoned.
Blockchain analytics firm Elliptic identified 117,000 NEAR tokens, worth $430,000, passing through the homemade coins between November 5 and November 7. The operation offers another look at how North Korea’s crypto laundering networks are adapting their techniques to move stolen assets.
Discover: The Best Token Presales
North Korea Memecoins: Liquidity Pools to Laundering Tools
Elliptic identified six newly created tokens on the NEAR blockchain: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token was paired with NEAR in its own decentralized exchange liquidity pool. The hackers then used one group of wallets to purchase the tokens with stolen NEAR before another group sold them back.
North Korea’s launderers are creating their own meme coins to move funds stolen from Binance.
Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went…— Elliptic (@elliptic) November 9, 2026
This separated the buying and selling wallets, preventing the stolen funds from moving directly between them. The transactions consequently resembled ordinary crypto trading, with the receiving wallets appearing to collect proceeds from successful memecoin trades.
Blockchain investigators could still follow the money. Elliptic found that almost all trading activity came from wallets connected to the laundering operation. Outside buyers accounted for less than 1% of one token’s trading volume.
The operation was also remarkably inexpensive. Creating each token cost just as low as 25 NEAR, or worth around $90. Five of the six token creators received funding from wallets that had already participated in earlier token sales.
The tokens were effectively disposable. All six stopped trading by November 8, with the creators of four withdrawing remaining liquidity.
The technique does not erase the transaction trail. Instead, it introduces additional steps that slow investigators trying to connect stolen funds with their eventual destinations. The firm previously identified a similar approach following the $1.5 billion Bybit hack in 2025. North Korean launderers moved at least $24 million through homemade tokens using the same basic mechanism.
Discover: The Crypto Presales This Q4 2026
Binance Hack Leaves Billions Moving Across Crypto Networks
The memecoin operation represents only a small fraction of the cryptocurrency stolen from Binance. The approximately $6.43 billion was taken from the exchange on October 29, making it the largest crypto theft ever recorded. Binance estimated its losses at $6.3 billion.
The FBI subsequently attributed the attack to North Korea’s TraderTraitor group. Investigators have identified multiple laundering techniques since the breach, including cryptocurrency swaps, cross-chain transfers, and movements through decentralized finance platforms.
Approximately $2.85 billion has been frozen, representing around 44% of the stolen assets. This leaves billions requiring further tracing as investigators race to identify wallets and freeze assets wherever possible.
BINANCE HACK: $6.3B IMPACT, $3B FROZEN ON-CHAIN, LOSSES FULLY COVERED!
Binance’s initial investigation suggests a compromised DevOps engineer’s laptop allowed an attacker to access a service container and submit unauthorized withdrawal transactions.
No evidence of a wallet… pic.twitter.com/NA5taJLmv5— Crypto Banter (@crypto_banter) October 30, 2026
The use of North Korean hackers and memecoins adds another disposable layer to this operation. Rather than relying exclusively on conventional exchanges or direct wallet transfers, hackers can manufacture trading activity around virtually worthless tokens.
Meanwhile, Bitcoin’s expanding Layer 2 ecosystem is attracting developers looking to introduce faster transactions and programmable financial applications to the network.
Bitcoin Hyper is among the projects pursuing this approach, combining a Solana Virtual Machine-based execution environment with Bitcoin settlement. Its proposed infrastructure targets near-instant transaction finality alongside decentralized applications and DeFi functionality.
The project currently records more than $33.2 million raised in its presale, with HYPER priced at just $0.0136877 and staking rewards of 35% APY.
As crypto infrastructure continues to evolve, the race between increasingly sophisticated laundering networks and blockchain investigators is unlikely to slow down.
Gain Access to New Bitcoin Layer 2 Early Before the Presale Window Ends In 2 Weeks
The post North Korea Hackers Launches Elon Musk Memecoins to Launder $6.4B Binance Hack appeared first on Cryptonews.
