North Korea Used 6 Meme Coins to Move $430K in Stolen Crypto

North Korean hackers have found a new use for worthless meme coins to move stolen crypto without directly linking the wallet holding the loot to the wallet receiving it. In the $6.3 billion Binance hack, about $430,000 in stolen NEAR passed through six homemade tokens.

Here’s how the hackers are using this method to launder crypto, a tactic they have also used in the past, including during the Bybit hack. 

North Korea Has a New Way to Launder Stolen Crypto

Blockchain analytics firm Elliptic says TraderTraitor, a North Korean hacking group linked to the Lazarus Group, is using short-lived meme coins to move stolen crypto and hide its trail. The group is now using this method to launder part of the $6.3 billion stolen in the Binance hack on October 29, 2026.

Between November 5 and 7, the hackers created six tokens on the NEAR blockchain, including FUK, OLCCL, MEILI, MMLI, DABI and SINU. Creating each token cost just 25 NEAR, or around $90.

They then paired the tokens with NEAR in liquidity pools on a decentralized exchange. Around 117,000 NEAR, worth about $430,000, passed through these tokens. Some of the funds were later converted into stablecoins or moved to other blockchains.

What makes this activity stand out is that almost all trading came from wallets linked to the hackers. Trading also stopped soon after the tokens had served their purpose. This points to the tokens being created specifically to move stolen funds, not to build regular meme coin projects.

North Korea’s Four-Step Meme Coin Strategy

Step 1: Create a worthless token

The hackers create a new meme coin using a public token-creation tool. Each token costs only a small amount of NEAR to launch.

Step 2: Create a liquidity pool

They pair the newly created token with a real cryptocurrency on a decentralized exchange.

Step 3: Trade the stolen crypto through the token

A wallet holding stolen crypto buys the newly created meme token, while another wallet sells it back through the same liquidity pool.

Step 4: Move the recovered funds

The receiving wallet gets the original cryptocurrency back, which can then be swapped into stablecoins or moved across different blockchains.

Why This Strategy Makes Crypto Tracking Harder

The technique does not make the stolen funds invisible. Every transaction remains recorded on-chain, allowing investigators to trace the movement. However, each additional swap creates more work for investigators

North Korea has used a similar approach before. After the 2025 Bybit hack, Elliptic identified at least $24 million moving through a worthless token created on Tron. 

Even the Binance case shows how North Korean-linked hackers are using low-cost methods across Tron, Solana, and NEAR to move stolen funds and make investigations harder.