Binance hack launderers mint homemade Elon Musk, animal memecoins to move stolen funds: Elliptic

North Korea's money launderers are spinning up throwaway memecoins to help obfuscate funds stolen in the $6.4 billion Binance hack, according to blockchain analytics firm Elliptic.

In a new report released Monday, Elliptic said about 117,000 NEAR, worth roughly $430,000 at the time, were routed into six newly created memecoins created between Nov. 5 and Nov. 7.

Like many other memecoins, the tokens feature animal mascots and one sporting an expletive ticker. Another features Elon Musk under an "Elon 2028 President" banner. Elliptic added that there was no suggestion that Musk himself was linked to it.

The launderers can then use decentralized exchange liquidity pools to separate wallets holding stolen funds from wallets taking in proceeds. One set of wallets will buy the memecoins with stolen NEAR, while another sells the token into the pool and collects NEAR in return.

"At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between," Elliptic wrote. "To a casual observer, the collecting wallets look like ordinary traders who have sold a token at a profit."

The tokens have all since been abandoned, with Elliptic adding that much of the NEAR collected went into stablecoins or cross-chain bridges.

Tactic used in Bybit laundering

Elliptic noted that this same tactic was used following the 2025 Bybit hack, with launderers moving around $24 million through a homemade token paired with a stablecoin on Tron.

In the Binance case, the firm also found evidence of a similar approach on Solana using existing tokens that had low liquidity.

The transfers are still public and traceable on the blockchain. Elliptic said the additional swaps are only meant to be hurdles to slow investigators down, giving the launderers a little extra time to move funds before their wallets get flagged.

The amounts moved through the six NEAR tokens are still small compared to the 11.8 million NEAR worth around $42.7 million at current prices.

This follows Elliptic's update from Friday, which tracked roughly $124 million in stolen assets converted into bitcoin. Binance's earlier incident report said that the attack had been in the works for months and involved malicious developer software, a fake job interview, and compromised AI tooling.

The exchange said the FBI linked the attack to North Korea.