The tremors of the Binance exploit are still being felt, as, according to a recent report by Elliptic, the North Korean hackers are using a new method to launder stolen cryptocurrency by creating their own worthless meme tokens.
Instead of transferring stolen funds directly between wallets, they are routing them through decentralized exchange (DEX) liquidity pools. This is done to make it harder and more time-consuming for investigators to trace where the money goes.
Details of the funds laundered
This time, the hacker started by creating a new cryptocurrency token using publicly available token-launch platforms. Soon after that, they paired this token with a legitimate asset, such as Near Protocol [NEAR] or a stablecoin, in a liquidity pool on a DEX.
Providing more insights on the matter, the report added,
Each of the six NEAR tokens carries a logo in classic meme coin style…The names follow meme coin habits too, from a crude joke (FUK) to an echo of the “-INU” dog coins (SINU).
They then used wallets holding stolen funds to buy the newly created token.
Finally, another set of wallets sold those tokens back into the same pool and withdrew legitimate crypto assets. Now since the liquidity pool sat between the buying and selling wallets, there was no direct transfer of stolen funds between them.
Old wounds resurface
According to this blockchain analytics firm, this technique was previously observed during the laundering of funds stolen from the Bybit hack in 2025.
At that time, too, the wrongdoers had moved at least $24 million through a worthless token created on the Tron [TRON] network.
The same approach has now appeared as Elliptic identified its use across TRON [TRX], NEAR, and Solana [SOL]. In fact, between 5th and 7th November, hackers created at least six memecoins on NEAR, including FUK, OLCCL, MEILI, MMLI, DABI, and SINU, with each token costing approximately 25 NEAR, or $90.
In this, around 117,000 NEAR, worth approximately $430,000, passed through these six tokens. The transactions followed a similar pattern, with tokens experiencing heavy trading within hours of creation before being abandoned. In some cases, the remaining liquidity was also withdrawn.
This followed the FBI attributing the theft to TraderTraitor, a North Korean state-sponsored hacking group. All this while, North Korean cyber-espionage group Kimsuky is increasingly using AI tools to strengthen its cyberattacks.
Final Summary
- Hackers created at least six memecoins on NEAR, with each token costing approximately $90.
- This technique was previously observed during the laundering of funds stolen from the Bybit hack in 2025.
