North Korea-Linked Hackers Use ‘Elon Musk’ Memecoins to Launder Binance Funds, Elliptic Says

Launderers linked to the North Korean hacking group TraderTraitor have created disposable memecoins, including one bearing an image of Elon Musk under an “Elon 2028 President” banner, as part of efforts to obscure funds stolen in the roughly $6.3–6.4 billion Binance hack on October 29, 2026, according to a report from blockchain analytics firm Elliptic. The firm traced about 117,000 NEAR tokens, worth roughly $430,000 at the time, through six newly created tokens on the NEAR blockchain between November 5 and 7. Elliptic emphasized that there is no suggestion Musk has any connection to the tokens.⁠Unchainedcrypto The FBI has attributed the Binance theft—the largest cryptocurrency heist on record—to TraderTraitor. North Korean officials have denied involvement, describing the allegations as “absurd rhetoric.” Elliptic and other firms have previously tracked similar tactics in the laundering of funds from the 2025 Bybit hack, which was also linked to North Korean actors. How the Memecoin Technique Works The launderers minted six short-lived tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each was paired with NEAR in its own liquidity pool on a decentralized exchange. One set of wallets used stolen NEAR to buy the new tokens; a separate set of wallets then sold the tokens back into the pools, collecting NEAR on the other side. Because the liquidity pool sits between the buying and selling wallets, no funds move directly from a wallet holding stolen assets to a collecting wallet. To an outside observer, the activity can resemble ordinary trading rather than a straightforward transfer of illicit funds.⁠Elliptic Elliptic found that nearly all trading volume came from the laundering wallets themselves. Outside buyers accounted for less than 1 percent of volume in one token and were essentially absent from the others. All six tokens were abandoned within days; trading stopped by November 8, and leftover liquidity was withdrawn. Creating each token cost roughly 25 NEAR, or about $90, making the method inexpensive to repeat. The tokens used typical memecoin imagery—a monkey with a pink bow, a duck against an American flag, a chimpanzee, a fox, and the Musk “Elon 2028 President” graphic. Scale Relative to the Broader Theft The roughly $430,000 moved through the NEAR memecoins represents a small fraction of the overall haul. Elliptic has estimated the total stolen at around $6.43 billion across multiple blockchains. Significant portions have already been frozen or seized—reports put the frozen or intercepted amount in the range of $2.85–3 billion, largely stablecoins that issuers could lock. Billions more remain under the control of addresses linked to the theft, primarily in Bitcoin and Ether, which cannot be frozen by a central issuer. Broader laundering has involved tens of thousands of wallets and transactions across numerous chains, often at high speed.⁠Theblock The same general approach—creating a worthless token and routing funds through a liquidity pool—was observed after the 2025 Bybit theft, where at least $24 million moved through a newly created token on TRON. Elliptic notes that North Korean-linked launderers typically layer multiple low-cost techniques rather than relying on any single method. The memecoin pools add an extra hop that slows investigators but does not eliminate the on-chain trail. Context of the Binance Incident The October 29 attack drained assets from Binance hot wallets in roughly 20 minutes across multiple blockchains. Binance has said it will cover customer losses and reported that a substantial share of the stolen assets was frozen relatively quickly. Subsequent movement of the remaining funds has involved automated wallet generation, cross-chain bridges, conversion into Bitcoin, and other obfuscation steps. Blockchain firms including Elliptic, TRM Labs, and Chainalysis have linked the activity to North Korean state-sponsored operations under the TraderTraitor banner, part of the broader Lazarus Group ecosystem. Pyongyang has consistently rejected such attributions. What to Watch Elliptic and other analytics firms continue to update public blocklists of addresses tied to the Binance theft as new wallets are identified. Exchanges and compliance teams are expected to re-screen deposits that may have passed through the NEAR tokens or related pools. The low cost of the memecoin method means similar disposable tokens could be used to move larger amounts in the future if the technique proves effective at delaying detection. Broader cash-out efforts—through over-the-counter brokers, mixers, and further chain-hopping—are likely to continue for months. Any additional freezes of remaining assets, further FBI or other law-enforcement actions, or shifts in the laundering playbook will be closely monitored by the industry and governments tracking North Korean cyber activity. The episode highlights both the adaptability of large-scale crypto laundering operations and the continuing visibility of those operations on public blockchains. While the specific Musk-themed token and animal-meme variants drew attention for their novelty, they form one small, inexpensive layer in a much larger and ongoing effort to move and obscure billions of dollars in stolen digital assets.