North Korea-linked launderers created at least six disposable memecoins on the NEAR blockchain between Nov 5 and Nov 7 to disguise funds stolen in the $6.4 billion Binance hack as ordinary trading proceeds, Elliptic said. Each token cost about 25 NEAR, or roughly $90, to launch and carried logos ranging from a monkey in a pink bow to an “Elon 2028 President” banner. The attackers paired the tokens with NEAR in decentralized exchange liquidity pools, bought them with stolen funds from one wallet and sold them back from another, moving about 117,000 NEAR worth $430,000 while leaving 11.8 million stolen NEAR worth $43.7 million untouched.
On Solana, the launderers swapped stolen SOL into existing wrapped and thinly traded tokens before selling them for USDC and bridging the proceeds across blockchains, repeating a memecoin wash-trading method Elliptic previously tracked moving at least $24 million after the 2025 Bybit hack. Across the wider operation, the hackers have routed funds through 65,000 transactions and more than 20,000 wallets on 16 blockchains, converting about $175 million in stolen altcoins into roughly 2,300 Bitcoin, up from $124 million a day earlier.
Meanwhile, Binance resumed withdrawals for HYPE and APT on Nov 8 and restored BNB Smart Chain, Ethereum, Base and Arbitrum network withdrawals for Binance Alpha on Nov 9. Co-founder Changpeng Zhao said in an Oxford Union interview that attackers spent five to six months planning the breach and that some employees failed to follow basic security procedures.
