INTEL: North Korea launders Binance hack funds through throwaway memecoins, Elliptic says

North Korean launderers are using newly created memecoins to move funds stolen in Binance’s $6.4 billion hack, according to blockchain analytics firm Elliptic. The firm says about $430,000 in stolen funds has so far passed through six new tokens.

One of the tokens features Elon Musk and carries an “Elon 2028 President” banner. Elliptic describes the tokens as throwaway assets, created to serve as a conduit for the stolen money rather than for any lasting market.

How the memecoin laundering works

According to Elliptic, the launderers move the funds through liquidity pools, which makes the transfers look like ordinary trades in the new tokens. That makes the movements harder to spot as stolen-fund transfers at first glance.

The amount traced so far is small next to the size of the hack. The $430,000 figure covers only what Elliptic has followed through the six tokens to date, and the picture is still developing.

Same tactic seen after Bybit

Elliptic said it previously tracked the same method moving at least $24 million after the 2025 Bybit hack. The comparison suggests the technique has been used at larger scale before, though the Binance-related flows identified so far are far lower.

The attribution to North Korea and the tracing of the funds come from Elliptic’s analysis. The supplied reporting does not include a statement from Binance on the laundering activity.