North Korean hackers who stole $6.43b from Binance now laundering funds through disposable meme coins

North Korean hackers who breached Binance, the world's largest cryptocurrency exchange, are laundering stolen funds by minting disposable meme coins, according to a new analysis.

Tom Robinson, co-founder of global blockchain analytics firm Elliptic, said Monday (local time) that the hackers are issuing worthless meme coins to disguise the movement of funds stolen in the Binance hack.

Meme coins are virtual assets issued online as internet trends or jokes, with prices that swing sharply depending on investor attention. North Korean hackers appear to be using them as a kind of container for money laundering.

According to Robinson's report, the hackers create worthless meme coins, then use wallets holding stolen virtual assets to purchase those coins, effectively moving the stolen funds. They continue the chain by using meme coins held in wallets with no suspicious transaction history to buy back the stolen assets. After this process, the wallet currently holding the stolen funds appears to outside observers to belong to someone who simply made an unexpected profit from meme coin trading.

"Thousands of new meme coins launch and disappear within days, so adding another short-lived coin attracts no attention," Robinson said. Because meme coins are inherently meaningless virtual assets, trading them between wallets holding stolen funds and ordinary trading wallets can make the value of those assets appear inflated.

The hackers are believed to have issued six meme coins — FUK, OLCCL, MEILI, MMLI, DABI and SINU. The confirmed laundering volume amounts to $430,000.

For cover, the hackers used logos depicting a monkey wearing a pink ribbon, or an image of Tesla and SpaceX CEO Elon Musk alongside the text "Elon 2028 President." The meme coins were traded only among hacker-linked wallets, with no outside buyers or sellers, before being abandoned. The operation followed a chain structure in which proceeds from selling one coin were used to mint the next, two to 13 minutes later, enabling the laundering of large sums.

The same technique was used in the Bybit hack, which has also been attributed to North Korean hackers. Elliptic noted that while blockchain records are permanent and funds cannot be completely hidden, methods like this can delay tracking by investigators.

Within a week of stealing the funds from Binance, the hackers mobilized more than 20,000 wallets and executed more than 65,000 transactions to launder the money — generating a new wallet roughly every 30 seconds and conducting a new transaction every 10 seconds.

Of the $6.43 billion the hackers stole, Elliptic said $2.85 billion has been frozen or seized. The assets still under the hackers' control amount to approximately $3.13 billion.