North Korean hackers are using a new tactic to launder funds from the $6.4 billion Binance breach: minting custom meme tokens. Blockchain analytics firm Elliptic revealed that the TraderTraitor or Lazarus group created a series of worthless coins to break the direct audit trail on digital ledgers.
Research led by Elliptic co-founder Tom Robinson found that this operation spans the Tron and Near networks, with similar variants on Solana. The goal is to leverage decentralized exchange liquidity pools to obfuscate transaction routes.
How Liquidity Pools Break On-Chain Trails
The hackers’ modus operandi relies on decentralized exchanges (DEXs). The perpetrators mint new tokens and create liquidity pools with native assets such as Near or stablecoins. Using stolen funds from one wallet, the hackers buy their own newly created tokens before a different wallet sells them back to withdraw clean assets.
This liquidity pool mechanism severs the direct on-chain link between the theft wallet and the collector wallet. On public transaction records, the receiving wallet appears to belong to an ordinary trader cashing out profits from meme coin trading.
$90 Capital for Six Coins on the Near Network
On the Near network, between November 5 and 7, 2026, the hackers minted at least six tokens. The creation cost for each token hovered around 25 NEAR, or approximately $90 per coin.
Token imagery ranged from a cartoon monkey with a ribbon, a duck wrapped in a flag, a chimpanzee, and a fox, to an ‘Elon 2028 President’ theme featuring Elon Musk’s face without his involvement. Token names spanned from profanities like FUK to dog coin parodies such as SINU.
All six tokens followed an identical pattern: launched, heavily traded within hours using stolen NEAR tokens, and then abandoned with the remaining liquidity pulled on November 8, 2026.
In total, around 117,000 Near worth roughly $430,000 was routed through the six tokens before most of it was converted into stablecoins or cross-chain bridges.
Not Erasing the Trail, but Buying Time
Elliptic emphasized that this meme coin trick does not completely eliminate the on-chain audit trail. The method merely slows down investigators’ analysis and buys time for the hackers to move funds before wallets are frozen.
Elliptic data shows that more than $3 billion in stolen Binance assets remains stored in on-chain addresses. To move the funds, the hackers are reportedly generating new wallets automatically every 25 seconds.
Elliptic previously observed a similar tactic during the $1.5 billion Bybit hack last year, which was also orchestrated by the same hacking group.
For investigators tracing the remaining $3 billion in Binance assets, the challenge lies in separating legitimate user transactions from hacker-created meme coins specifically designed to stall for time.
Reported by Decrypt.
Also read: How to Read Candlestick Charts for Beginners
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
