Meme Coins as the New Laundromat
In early November, North Korean hackers took an unconventional approach to laundering stolen crypto: they minted their own meme coins.
Each token cost about 25 NEAR—roughly $90—to create, a small price for a laundering operation of this scale. The hackers paired each token with NEAR in its own liquidity pool on decentralized exchanges, making it possible to swap stolen funds between wallets while muddying the transaction trail.
Elliptic notes that this method is not entirely new. A similar strategy was used after the $1.5 billion Bybit hack in 2025, when North Korean-linked groups laundered at least $24 million via a freshly minted token on the TRON blockchain. However, the use of meme coins themed around Elon Musk and animals marks a notable evolution in obfuscation tactics.
Six Tokens, Zero Real Traders
Despite their playful names—FUK, OLCCL, MEILI, MMLI, DABI, and SINU—the six NEAR tokens saw almost no outside trading activity. According to cointelegraph.com, these coins were essentially shells: they existed solely to move illicit funds and were abandoned within hours of launch. Five of the six token creators received funding from earlier token sales just minutes before launching the next coin, underscoring how tightly choreographed the operation was.
None of these tokens have traded since November 8.
Within days, the creators withdrew any remaining liquidity from four of the tokens and left them dormant. This rapid cycle—minting a token, funneling funds through it, then abandoning it—helped slow down investigators but did not erase the on-chain evidence entirely.
NEAR Blockchain at the Heart
The NEAR blockchain played a central role in this laundering scheme. Between November 5 and 7 alone, about 117,000 NEAR (worth roughly $430,000) was moved through these meme coins before being swapped for stablecoins or bridged elsewhere. Yet even after these maneuvers, a significant portion—11.8 million NEAR valued at $43.7 million—remained unmoved as of Elliptic’s analysis.
This creates a contrast: while some funds are quickly laundered through elaborate schemes involving self-minted tokens and decentralized exchanges, much larger sums remain frozen in place for weeks or longer. More than $3 billion worth of stolen crypto from the Binance hack has yet to be laundered at all; meanwhile, new wallets are reportedly being spun up every 25 seconds to keep assets on the move.
See Also
Flash-Minted Tokens, Fast-Moving Funds
The laundering process was not limited to NEAR; Elliptic tracked activity across at least 16 blockchains and more than 20,000 wallets connected to this theft. Each homemade token was heavily traded within hours of creation using only stolen NEAR tokens as liquidity before being discarded. In total, analysts have documented at least 65,000 transactions related to this incident.
Despite these efforts to hide their tracks by creating extra swaps and using themed memecoins referencing Elon Musk or animals, investigators maintain that all movements remain traceable on-chain. The extra complexity slows down forensic work but does not make it impossible.
The headline figure—$6.3 billion stolen—grabs attention, yet the reality is more nuanced: while hundreds of thousands of dollars have been laundered through creative means like meme coins on NEAR and TRON blockchains, billions remain untouched or only partially moved as law enforcement continues to track every transaction.
What Matters
- •Between Nov. 5 and 7, North Korean hackers laundered about $430,000 in stolen Binance funds through six self-created tokens on NEAR.
- •Each memecoin cost roughly 25 NEAR (around $90) to mint, with names like FUK, OLCCL, MEILI, MMLI, DABI, and SINU.
- •As of Elliptic’s analysis, 11.8 million NEAR ($43.7 million) from the $6.3 billion Binance hack remains unmoved.
What to watch closely
If the remaining 11.8 million NEAR (valued at $43.7 million) stolen in the Binance hack and still unmoved as of Elliptic’s latest analysis begins to shift from current wallets, it would immediately signal a new laundering phase by North Korean-linked actors using tactics such as self-minted memecoins on blockchains like NEAR or TRON.