A money-laundering group suspected of links to North Korea is believed to have issued its own memecoins to launder cryptocurrency stolen in a Binance hack. It tried to hide traces of direct fund movements between wallets by putting the stolen funds into liquidity pools on decentralised exchanges (DEX) and then swapping them into other assets.

On Nov. 9 (local time), blockchain media outlet Decrypt reported that blockchain analytics firm Elliptic said it confirmed the laundering method on the Tron and Near blockchains, and detected similar cases on Solana.

The method begins with issuing a proprietary token. The group pairs stolen cryptocurrency with the newly created token to form a liquidity pool, then uses the stolen funds to buy the token. It then sells the token from another wallet to obtain stablecoins or other cryptocurrencies. Because the liquidity pool intervenes in the middle, it blurs the direct link between the wallet where the funds first moved and the final receiving wallet.

The clearest case was confirmed on the Near blockchain. Elliptic said the laundering group issued at least 6 proprietary tokens from Nov. 5 to 7 and created separate liquidity pools linking each token to Near.

The tokens were made to look like typical memecoins, using images such as monkeys, ducks, chimpanzees and foxes. One token used an image reading “Elon 2028 President” that had no connection to Elon Musk. The cost to issue the tokens, named FUK and SINU among others, was about 25 Near each, about $90 at the exchange rate at the time.

Trading patterns were similar across the 6 tokens. Trades using stolen Near were concentrated for several hours right after issuance, and the tokens were then effectively abandoned. The remaining liquidity was withdrawn on Nov. 8. Funds moved through this process totalled 117,000 Near, about $430,000. A significant portion was later moved to stablecoins or cross-chain bridges.

The laundering volume confirmed so far, however, is only a portion of the total stolen funds. Elliptic assessed that more than $3 billion in stolen cryptocurrency remains unlaundered. The group also appears to have created new wallets about every 25 seconds to spread funds in ways that make them harder to trace.

Elliptic stressed that the method does not make on-chain tracing itself impossible. Fund flows can still be traced, but routing them through liquidity pools and many wallets is intended to make law enforcement agencies and analytics firms take longer to track them. The final receiving wallets may also appear, on the surface, like ordinary investors trading memecoins.

This is not the first time such a method has been confirmed. Research by Elliptic co-founder Tom Robinson (톰 로빈슨) found that a similar approach was detected during efforts to trace funds from a 2025 Bybit hack. That incident was also said to be linked to the TraderTraitor group, which has been identified as being behind the Binance breach.

Elliptic warned cryptocurrency exchanges and anti-money laundering and compliance officers to closely scrutinise liquidity pools tied to newly issued tokens and a small number of wallets. It said swapping stolen funds into other assets through a liquidity pool does not make their origins clean.