North Korea’s memecoin laundry gets an Elon 2028 twist 🧼

North Korean hackers linked by the FBI to the $6.4 billion Binance theft are using newly created memecoins to launder stolen cryptocurrency, according to blockchain analytics firm Elliptic. Between Nov. 5 and 7, the hackers launched at least six tokens on the NEAR blockchain, routing about 117,000 NEAR Protocol (NEAR), valued at roughly $430,000, through decentralized liquidity pools.

Each token cost about 25 NEAR, roughly $90, to create and was paired with NEAR in a separate liquidity pool. One group of wallets swapped stolen NEAR for the new token, while another group sold it back for NEAR, breaking the direct onchain connection between the original wallets and those collecting the proceeds. Five of the six creators received funding from earlier token sales between two and 13 minutes before launching their next token.

The tokens included cartoon images of a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. Another displayed Elon Musk beneath the banner “Elon 2028 President,” although Elliptic said Musk had no connection to the tokens. Names ranged from FUK to a riff on dog coins, SINU. Outsiders bought less than 1% of one token’s trading, while the hackers generated nearly all activity before pulling the remaining liquidity on Nov. 8.

Elliptic said the maneuver did not conceal the transactions, which remained traceable onchain. “It does not hide the funds so much as slow down the people tracing them,” the firm’s report said, citing co-founder Tom Robinson. “North Korea’s launderers rarely rely on a single technique,” Robinson wrote. “Instead, they layer many cheap techniques, each adding a little more delay.”

Elliptic said the same technique moved at least $24 million following the $1.5 billion Bybit hack in 2025, with North Korean-linked actors using a newly created token on the TRON blockchain. The analysts also identified the method on Tron and Near, with a close variant on Solana. About 11.8 million stolen NEAR, worth $43.7 million, had not moved at the time of the analysis. Elliptic said exchanges that had already accepted deposits from these trades should review them again as its blocklist expands, while stressing that the launch tool, exchange and wallet app did nothing wrong.