North Korea Is Minting Throwaway Meme Coins to Wash Binance Hack Cash

North Korean launderers have a new trick for washing stolen crypto: build a throwaway meme coin, park it in a liquidity pool, and let the pool do the dirty work. Blockchain analytics firm Elliptic traced the playbook to the crew behind the $6.4 billion Binance hack, and says the tokens are being spun up on Tron, NEAR and Solana.

The mechanics are simple. Attackers mint a token, pair it with a real asset like NEAR or a stablecoin, and drop it into a decentralized exchange pool. One set of wallets buys the junk token with stolen funds; a separate set sells it back and walks away with the legitimate crypto. With the pool sitting between them, the money going in and the money coming out no longer look connected at a glance.

Elliptic first spotted the pattern while chasing funds stolen from Bybit in 2025, when North Korean wallets built a worthless Tron token and pushed at least $24 million through a pool. It resurfaced almost immediately after the Binance heist. On November 2, Elliptic flagged a freshly minted Tron token that looked custom-built for laundering. A day later, stolen Solana was swapped into wrapped and thinly traded tokens, converted to USDC and bridged to other chains.

NEAR gave the clearest picture. Between November 5 and 7, the attackers created six tokens — FUK, OLCCL, MEILI, MMLI, DABI and SINU — each paired with NEAR in its own pool. Minting a token cost about 25 NEAR, roughly $90 apiece. Together the six moved around 117,000 NEAR, worth about $430,000, with the buying wallets funded straight from stolen NEAR. Nearly the same amount exited through separate wallets, much of it converted to stablecoins or sent over a cross-chain bridge.

The trading fingerprints gave it away. Laundering-linked wallets handled almost all the activity, and DABI, MMLI and SINU each had exactly one buying wallet and one selling wallet. All six tokens were hammered after launch, then dropped — none has traded since November 8. Proceeds from earlier tokens even funded the creation of newer ones, tying the operation together.

Elliptic says the swaps don't erase the blockchain trail, just make following it slower. At $90 a pop, the attackers can afford to run it again and again. The six NEAR tokens moved a sliver of the loot — Elliptic estimates around 11.8 million NEAR, worth approximately $43.7 million, is still sitting unmoved. The firm is now warning exchanges and compliance teams not to treat liquidity-pool funds as clean by default, pointing to brand-new tokens, pools with barely any wallets, and accounts funded moments before trading as red flags.