North Korean hackers create memecoins to launder funds from Binance hack: Elliptic

North Korean hackers created memecoins to launder cryptocurrency stolen in the $6.4 billion Binance hack, routing roughly $430,000 through six newly launched tokens on the NEAR blockchain, according to a report from blockchain analytics firm Elliptic.

Between Nov. 5 and 7, the hackers created at least six tokens on NEAR and used liquidity pools on decentralized exchanges to move stolen funds between wallets, Elliptic said. The tokens attracted almost no outside trading and were abandoned shortly after launch.

The hackers used one set of wallets to swap stolen NEAR tokens for the new memecoins, then used another set to sell those memecoins back into the pools for NEAR. The swaps let them move funds without direct wallet-to-wallet transfers, though the transactions remained traceable onchain.

How stolen NEAR moved between wallets through liquidity pools. Source: Elliptic

Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales just two to 13 minutes before the next launch, linking the tokens in a chain of transactions.

“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”