Cartoon animals and an “Elon 2028 President” image gave a set of newly minted tokens the familiar look of meme coins. But according to blockchain analytics firm Elliptic, the tokens were disposable tools used by North Korean hackers to launder part of the reported $6.4 billion stolen from Binance. Elon Musk had no connection to the tokens.
Decrypt’s report, published on November 10, 2026, at 03:36:02 UTC+8, described how the launderers borrowed meme-coin imagery to make receiving wallets resemble ordinary traders cashing out.
Familiar imagery, short-lived tokens
Elliptic’s research, credited to co-founder Tom Robinson, identified the technique on Tron and Near, with a close variant on Solana.
The clearest example involved at least six tokens created on Near between November 5 and 7. Their logos included a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox, alongside the Musk-themed image. Names included FUK and SINU, the latter a riff on dog coins.
Each token cost about 25 NEAR—roughly $90—to create and was paired with NEAR in its own liquidity pool. All six followed the same pattern: launch, heavy trading within hours using stolen NEAR, then abandonment. The remaining liquidity was withdrawn on November 8.
About 117,000 NEAR, worth roughly $430,000, passed through the six tokens. Much of that value subsequently moved into stablecoins or a cross-chain bridge, according to the report.
How the pools separated the wallets
The method used a newly created, otherwise worthless token paired with a real asset, such as NEAR or a stablecoin, in a decentralized-exchange liquidity pool.
One set of wallets used stolen funds to buy the token. A separate set sold it back into the pool and withdrew the paired asset. Because the pool sat between the two groups, there was no direct transfer of stolen funds from the buying wallets to the wallets collecting the proceeds.
That separation made the withdrawals look more like ordinary trading activity. It did not make the funds untraceable. Elliptic stressed that the trail remained fully visible onchain; the maneuver added investigative work and bought time before funds could be flagged.
A small part of a larger laundering effort
The amounts routed through these tokens were modest relative to the reported theft. Elliptic had previously found that more than $3 billion of the stolen cryptocurrency remained unlaundered, while the operators were creating a new wallet roughly every 25 seconds.
The firm first observed this meme-token technique in 2025 while tracing the $1.5 billion Bybit theft. That attack was also attributed to TraderTraitor, the group identified as being behind the Binance breach.
For compliance teams, Elliptic’s warning was specific: assets received from a liquidity pool should not automatically be treated as clean, particularly when newly minted tokens and only a handful of trading wallets are involved. In this case, familiar meme imagery accompanied a short-lived laundering mechanism—not evidence of an organic community taking shape.
Source: Original Decrypt article, published November 10, 2026, at 03:36:02 UTC+8.