North Korean cybercriminals linked to the TraderTraitor group have transferred approximately $430,000 in stolen digital assets from the Binance platform through a series of custom-made memecoins, according to a new report from blockchain analytics firm Elliptic. The operation took place in the days following Binance’s $6.4 billion security breach, the largest in the exchange’s history.
Memecoins Created for Laundering
Elliptic revealed that hackers conducted a sophisticated laundering scheme by introducing six new cryptocurrencies: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. These tokens were established with minimal upfront costs, each requiring around 25 NEAR tokens—valued at approximately $90 at the time—for creation. The tokens were immediately paired with NEAR on decentralized exchanges, forming liquidity pools to facilitate trades.
The process unfolded with attacker-controlled wallets buying the memecoins using assets acquired in the Binance hack. Separate wallets, also under the group’s control, subsequently sold the same tokens through the pools. This sequence enabled the group to receive NEAR tokens without direct transfers from the original theft-associated addresses and gave the resulting transactions the appearance of ordinary marketplace activity.
Investigators noted that nearly every memecoin transaction involved only wallets linked to the laundering operation, with three of the tokens recording activity from just a single buyer and a single seller.
Trading in all six memecoins ceased by November 8, indicating they were designed specifically for temporary use in laundering rather than as lasting cryptocurrency projects. Elliptic described these tokens as “worthless,” intended only for facilitating movement of illicit funds.
Expansion of Fund Movements Post-Hack
While the $430,000 filtered through memecoins represents a small fraction of the total loss, Elliptic’s analysis showed the broader laundering operation spanned 16 blockchain networks. Investigators tracked over 20,000 wallets and more than 65,000 transactions across at least 36 services.
As of November 9, approximately $3 billion remained in addresses connected to the hackers, with most funds held in Bitcoin and Ethereum. Authorities and impacted platforms had managed to freeze a further $2.85 billion to prevent movement.
The scale of these transactions highlights the challenges faced in containing large-scale cryptocurrency theft, even as some assets are successfully frozen through issuer intervention or regulatory cooperation.
Earlier investigations also uncovered the theft of around $296 million in XRP, and separate asset freezes have demonstrated the effectiveness of centralized controls in limiting fund mobility for certain tokens.
Mini dictionary: Elliptic is a London-based blockchain analytics firm known for tracking and analyzing cryptocurrency transactions, especially those linked to crime and sanctions violations. The company works with regulators and exchanges worldwide to identify illicit activities involving digital assets.
| Item | Value |
|---|---|
| Total funds stolen (Binance hack) | $6.4 billion |
| Funds laundered via memecoins | $430,000 |
| Funds frozen | $2.85 billion |
| Funds remaining with hackers | $3 billion |
| XRP stolen (prior attack) | $296 million |
| Number of wallets involved | 20,000+ |
| Blockchains used | 16 |
Recurring Tactics Mirror Previous Breaches
The latest use of memecoins to obscure transaction trails follows strategies observed in earlier cyberattacks. After the 2025 Bybit hack, North Korean-linked actors reportedly transferred at least $24 million via a homemade token on the Tron network, demonstrating a pattern of leveraging new tokens and decentralized infrastructure for laundering sizeable thefts.
Such methods underline the evolving complexity of tracing illicit cryptocurrency flows through decentralized finance (DeFi) services, which allow anonymous and rapid asset swaps beyond the reach of traditional oversight.
Security experts continue to warn that the rapid creation and disposal of new tokens make transaction tracing more difficult and challenge the ability of exchanges to identify and freeze suspect funds in a timely manner.
