North Korea-linked launderers have created throwaway memecoins to move roughly $430,000 from the $6.4 billion Binance hack through decentralized exchange pools, according to Elliptic.
Summary
- Launderers created six NEAR tokens and routed stolen funds through their own liquidity pools.
- Elliptic says pool payouts can resemble trading proceeds, although the transactions remain traceable.
- Investigators have tracked the laundering across more than 20,000 wallets on 16 blockchains.
- Tornado Cash has received roughly 7,000 ETH linked to the theft since Nov. 8.
Elliptic, in a Nov. 9 report by Tom Robinson, said the operators minted FUK, OLCCL, MEILI, MMLI, DABI and SINU between Nov. 5 and 7. Each cost around 25 NEAR, or $90, to create.
The operators paired their tokens with NEAR in separate trading pools, then routed approximately 117,000 stolen NEAR through them. Similar activity appeared on Tron, while a related Solana route used existing, thinly traded tokens.
Memecoin pools make transfers look like trades
In Robinson’s account, one group of wallets bought the tokens using stolen cryptocurrency, while another sold tokens into the same pool and collected the real assets. With the pool between them, the wallets did not transfer funds directly.
The receiving accounts could consequently resemble traders taking profits. Robinson warned that compliance teams should not assume funds are clean simply because they arrive from a liquidity pool.
“The trail can still be followed on-chain,” the report said.
The technique predates this theft: Elliptic identified its use after the 2025 Bybit hack. Its stated effect is to delay investigators, with cheaply created tokens discarded after use.
Binance laundering reaches Tornado Cash
Elliptic’s separate laundering tracker, updated Nov. 9 at 13:15 UTC, put the operation at more than 20,000 wallets across 16 blockchains. Its count covered at least 36 services and 65,000 transactions.
Since Nov. 8, wallets linked to the theft have deposited roughly 7,000 ETH, valued at $15 million, into Tornado Cash. Some deposits came from bitcoin that had already passed through coinjoin transactions before being converted back into ETH.
Across the operation, around 3,000 BTC worth $225 million had accumulated in new addresses after conversions from other stolen assets. The main Bitcoin and Ether holdings had not moved, according to the tracker.
Around $3 billion remained in theft-linked addresses, while $2.85 billion was frozen. Elliptic estimated that only a negligible amount had likely been cashed out.
The tracker said the FBI attributed the theft to TraderTraitor on Oct. 31 and urged services, including THORChain operators, to block linked transactions.
Binance traced the breach to employee computers
Binance’s Nov. 3 account described a months-long intrusion involving developer software, fake recruitment interviews and access to internal systems, as crypto.news previously reported.
In June, an earlier encounter involving a tampered Homebrew installation had exposed an engineer’s role and colleagues, the exchange said.
During a September interview process, an engineer downloaded an assignment repository onto a work computer. According to the exchange, malicious code replaced a legitimate development tool and escaped detection by its endpoint security systems.
On Oct. 20, the attacker used the compromised computer and an internal AI tool to reach two wallet engineers’ machines. Stolen container deployment credentials subsequently provided access to wallet signing operations.
The exchange put the impact at $6.34 billion and said it had set aside more than the full amount to cover losses.
Separate technical findings described how malicious EIP-7702 permissions enabled an Ethereum wallet to execute attacker-controlled code. Blockaid identified 50 authorizations submitted in one transaction, with one successfully matching the Binance 14 wallet’s transaction counter.
Because the wallet was actively processing withdrawals, its counter kept changing. Blockaid said the authorizations covered consecutive counter values, giving the attacker multiple chances to match the value when the transaction executed.
Binance’s initial investigation said it had found no evidence that a wallet private key had leaked.
Frozen Arbitrum funds require a governance vote
Recovery efforts include a Nov. 5 request for the return of frozen assets, comprising 8,425.997 ETH and 74.56 million ARB immobilized on Arbitrum.
The network’s Security Council temporarily upgraded a contract to move the assets into a frozen address, then restored the original implementation. Moving those balances again requires DAO approval.
Binance proposed returning the existing frozen assets through a temporary contract upgrade, without seeking a fresh treasury allocation. Recovered assets could cover incident-related costs and replenish reserves already used to compensate customers, according to the proposal.
The exchange estimated seven weeks or longer for discussion, voting, and execution. Its proposed schedule included a week of forum discussion, a weeklong temperature check, a two-week onchain vote, and roughly 18 further days before execution following approval.
