North Korean hackers moved about 117,000 NEAR tokens — roughly $430,000 — out of the $6.3 billion Binance hack by cycling the funds through six homemade memecoins, according to blockchain analytics firm Elliptic. The tokens were created for the express purpose of obscuring the money trail, Elliptic said.
How the memecoin wash worked
The operation didn't rely on established exchange liquidity or privacy coins. Instead, the hackers built their own tokens from scratch, then used them as a laundering layer. Elliptic's analysis found six separate memecoins deployed as part of the same scheme. Funds from the Binance hack were pushed through these tokens, breaking the on-chain link between the original theft and the eventual cash-out.
Memecoins are cheap to mint and often trade on thin liquidity, which makes them attractive for this kind of activity. A token with almost no organic trading volume can absorb large transfers without moving the price much, and the resulting transactions look like ordinary degen speculation rather than structured laundering.
Why 117,000 NEAR matters
The dollar figure — about $430,000 — is small next to the $6.3 billion Binance hack. That gap is the point. Elliptic's findings suggest the hackers aren't trying to move the whole haul at once. They're testing routes, and memecoins are one of the routes that worked, at least for this batch.
NEAR, the token of the NEAR Protocol blockchain, was the starting asset for this particular leg. It's not clear from Elliptic's analysis whether the 117,000 NEAR was held from the original hack or converted into NEAR at some earlier stage. What is clear is that the tokens ended up in memecoin contracts controlled by the hackers before being dispersed.
Elliptic's tracking role
Elliptic has been one of the firms tracking North Korean crypto activity for years, and its attribution of this operation to North Korean hackers follows a pattern of similar findings by the London-based company. The firm's analysis identifies the six memecoins but the facts released don't name them, and it's not known whether exchanges have been alerted to the specific contracts.
The Binance hack remains one of the largest crypto thefts on record. The $6.3 billion figure dwarfs most other exchange breaches, and the recovery of any portion of the funds has been slow. The memecoin laundering route is a reminder that the stolen assets aren't sitting in a single wallet waiting to be seized — they're being actively moved.
What happens to the memecoins
Tokens created for laundering typically have no afterlife. Once the funds are through, the contracts are abandoned and the tokens become worthless. That leaves investigators with a trail of dead contracts and a small pool of NEAR that may or may not still be traceable to the original hack.
Elliptic's findings don't include an estimate of how much of the $6.3 billion has been laundered this way. The 117,000 NEAR batch is one data point. Whether the same memecoin technique has been used for larger transfers is the question investigators are likely working on now. Elliptic hasn't said whether it has identified additional batches, and the hackers, presumably, are still moving.
