North Korean Hackers Use Meme Coins to Launder Stolen Assets
North Korean Hackers Use Meme Coins to Launder Stolen Assets – How $430,000 in NEAR Tokens Moved Through Decentralized Exchanges
Key Takeaways
- Cybercriminals linked to North Korea minted six custom meme coins to process 117,000 stolen NEAR Protocol tokens.
- The laundered funds originate from a $6.4 billion theft in October targeting the Binance exchange.
- Each fake token cost about $90 to create and utilized decentralized exchange liquidity pools to obscure the money trail.
- Roughly 11.8 million stolen NEAR remains unmoving in hacker wallets, representing $43.7 million in pending assets.
Decentralized Liquidity Pools Serve as Washing Mechanisms
Blockchain analytics firm Elliptic revealed on Monday that hackers are deploying their own meme coins to obscure funds stolen from Binance. The laundering process relies on liquidity pools, which act as automated swap booths on decentralized exchanges. Criminals set up these pools by pairing their newly minted tokens with the stolen NEAR Protocol assets.
The operation involves two distinct sets of cryptocurrency wallets to create the illusion of legitimate trading activity. One group of wallets uses the stolen NEAR to purchase the homemade meme coin. A second group of wallets then sells the meme coin back into the liquidity pool, walking away with what appears to be clean NEAR tokens.
This multi-wallet structure ensures that the money never moves directly from the original thief to the final receiver. On the public blockchain, the sellers appear to be fortunate traders capturing quick profits. The launch tools, wallet applications, and decentralized exchanges operate exactly as intended during this process. The launderers simply use the standard infrastructure available to any regular customer.
American Visual Themes Disguise Malicious Tokens
The cybercriminals utilized American cultural and political themes to dress up their fake tokens. One prominent coin featured an image of Elon Musk displayed beneath an “Elon 2028 President” banner. Another token logo displayed a duck positioned in front of a United States flag. Elliptic confirmed that Musk has absolutely no connection to these digital assets or the laundering operation.
These tokens require minimal upfront investment from the hacking groups. Each fake coin cost approximately $90 to launch on the blockchain. The profits generated from successfully cashing out one token immediately fund the creation of the next one in the sequence.
External participation in these specific markets remains practically non-existent. Legitimate retail traders purchased less than one percent of the total trading volume across the six identified tokens. The assets experience heavy trading volume for just a few hours before the activity completely dies off.
Speed Remains the Primary Goal for Tracing Evasion
The primary function of this meme coin strategy is not absolute anonymity. Tom Robinson from Elliptic explained in a company blog post that the method serves to slow down the investigators tracing the digital funds rather than completely hiding them. The hackers operate under strict time constraints to liquidate their holdings.
Criminals must successfully cash out their assets before their wallet addresses land on industry blocklists. The tactic has proven successful in previous high-profile incidents. Hackers utilized the exact same liquidity pool manipulation to move at least $24 million following the Bybit exchange hack in 2025.
The burden of detection now falls heavily on the platforms receiving these funds. Exchanges that have already accepted and cleared deposits linked to these trades must re-evaluate those transactions. Elliptic advises platforms to conduct secondary checks as the official blocklist of associated wallets continues to expand.
Millions in Stolen Assets Still Await Processing
The current meme coin laundering campaign represents only a tiny fraction of the total compromised funds. The processed 117,000 NEAR tokens carry an estimated value of $430,000. This amount constitutes less than one percent of the total NEAR assets controlled by the North Korean group.
The original capital stems from a massive $6.4 billion exchange theft that occurred in October. The United States Federal Bureau of Investigation officially attributed that massive security breach to hackers from North Korea.
A massive stockpile of digital assets remains stationary on the blockchain. Elliptic estimates that approximately 11.8 million stolen NEAR tokens have not yet moved from their holding wallets. These idle funds hold a current estimated value of $43.7 million, suggesting that investigators and exchanges will face continued laundering attempts in the near future.
Our Assessment
The deployment of custom meme coins introduces a highly structured method for delaying blockchain forensics. By leveraging standard decentralized exchange mechanics and automated liquidity pools, malicious actors can create artificial trading environments that temporarily mask the origin of stolen assets. With $43.7 million in stolen NEAR still awaiting movement, the reliance on rapid, low-cost token launches will likely continue. Receiving exchanges face an ongoing operational challenge, as they must continuously audit previously cleared deposits against rapidly updating blocklists to prevent the final off-ramping of these illicit funds.
