North Korea Launderers Mint Memecoins to Move Binance Loot

Blockchain analysis firm Elliptic reported on Monday Nov 9, 2026, that launderers linked to North Korea are creating their own memecoins to move funds stolen in the Binance hack. The FBI has attributed the Oct 29, 2026 Binance theft, put at $6.3 billion, to North Korea's TraderTraitor group.

Between Nov 5 and Nov 7 the launderers created at least six tokens on the NEAR blockchain. The tokens are FUK, OLCCL, MEILI, MMLI and DABI, and SINU. Each token cost about 25 NEAR, around $90, to create.

The method is small beside the size of the theft. About 117,000 NEAR, worth around $430,000, passed through the six tokens. That is less than 0.01 percent of the total stolen.

How the wash works

Each token was paired with NEAR in its own liquidity pool on a decentralised exchange. One set of wallets bought the tokens with stolen NEAR. A second set of wallets sold them back.

That split is the point of the design. The funds never passed directly from the wallets holding stolen assets to the wallets that received them. The token and its pool sit between the two sets of wallets.

Elliptic co-founder Tom Robinson described the tokens as single use tools. In his account, the tokens are made to be used once and thrown away, nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set.

Outside interest was near zero. Outside buyers made up less than 1 percent of one token's volume.

A short life for the tokens

None of the six tokens has traded since Nov 8. That afternoon the creators of four of them withdrew the liquidity that was left.

The pattern has appeared before. Elliptic first reported the method in the laundering of the February 2025 Bybit hack. Elliptic has seen the same technique on Tron, where a token created only to launder funds was identified on Nov 2. Elliptic has also seen a related approach on Solana.

The NEAR case adds a new chain to that record. Each version uses a fresh token, a fresh pool and a short window of activity before the token goes quiet.

Most funds have not moved

About 11.8 million NEAR, worth $43.7 million, from the Binance theft has not yet moved. The memecoin route so far covers only a small share of the stolen funds that have moved at all.

Elliptic says every step is recorded on the blockchain. In that account, the technique slows investigators rather than hiding the funds. The trades, the pools and the liquidity withdrawals all leave a public record.

That record is what allowed the six tokens to be identified within days of their creation. The launderers gained distance between wallet sets. They did not gain invisibility.

Investigators now hold a map of the NEAR trades from Nov 5 to Nov 7 and the halt that followed on Nov 8. The larger question is where the unmoved 11.8 million NEAR goes next and whether the same single use token method appears again on NEAR or on another chain.