Disposable meme coins have helped hackers launder around $430,000 from the $6.3 billion Binance theft, according to crypto research firm Elliptic. The firm says Pyongyang is creating the tokens to move stolen cryptocurrency through liquidity pools.
The Binance break-in happened last month, with the attackers described as likely working on North Korea’s behalf. They stole $6.3 billion from the world’s largest crypto exchange in just 20 minutes after spending months on complex planning. It was the largest theft in crypto history.
Elliptic’s blog post on the scheme identifies at least six meme coins that it believes are connected to the laundering operation. All were created shortly after the heist.
A meme coin is a speculative digital asset, typically themed around a viral meme, celebrity, or niche internet joke. The tokens Elliptic describes serve a different purpose: they’re worthless and intended to be used once, but whoever creates them can assign their price. That makes them a perfect “container” for transferring stolen crypto, in Elliptic’s words. Creating them costs little, so the laundering method is cheap, too.
“Most people think of meme tokens as joke coins whose prices rise and fall on hype,” Elliptic cofounder and chief scientist Tom Robinson wrote in the firm’s blog post. “North Korea’s launderers have found a different use for them, creating tokens that nobody else wants to buy and using them to disguise the movement of stolen funds.”
The source article describes the coins’ appearance as dumb and worthless. Elliptic says one shows Elon Musk beneath a banner reading “Elon 2028 President.” The source calls Musk a sometimes-trillionaire, but there’s no evidence he has any involvement in the scheme. The other designs include a monkey wearing a pink hair bow and a strange-looking duck against an American flag. One token’s name is simply “FUK.”
The sheer volume of disposable meme coins helps these transactions blend in, Robinson explained. “Meme coins are launched and traded in their thousands, and most fade within days, so one more short-lived token with a cartoon logo attracts little attention,” he wrote. “A wallet whose history shows trades in a new meme coin looks like a speculator rather than a launderer, unless someone checks where its money came from.”
Elliptic has documented a similar approach before. The same North Korean hacking group stole $1.5 billion from crypto exchange Bybit last year. In its investigation of that theft, Elliptic found that the attackers had used meme coins to move at least $24 million of the stolen funds.
