Crypto: Binance Hackers Launder $430K Through Memecoins

The hackers responsible for the Binance hack use their own memecoins to launder some of the stolen cryptocurrencies. According to Elliptic, six tokens launched on NEAR between November 5 and 7 facilitated the transit of approximately $430,000. Crypto transactions remain visible on the blockchain, but tracing them becomes more complex.

Binance hack: six memecoins created on NEAR

On October 29, 2026, hackers emptied Binance hot wallets. The crypto exchange estimates the impact at around 6.3 billion dollars. On October 31, the FBI attributed the theft to TraderTraitor, a group linked to North Korea. Pyongyang denies the accusation.

In a report published on November 9, Elliptic describes this tactic. Six tokens were created on NEAR in three days. Their visuals feature notably a monkey, a duck, or a “Elon 2028” poster, with no established link to Elon Musk. Each creation cost about 25 NEAR, or 90 dollars.

In total, nearly 117,000 NEAR passed through these memecoins. This represents nearly $430,000. Elliptic also identified a comparable token on Tron as well as a variant on Solana.

How do memecoins serve crypto laundering?

A laundering memecoin is a token used to transit stolen crypto funds via a liquidity pool. This mechanism adds a step between the wallet providing the funds and the one receiving the asset.

Specifically, the launderer pairs their token with an asset, like NEAR, in a pool on a decentralized crypto platform (DEX).

• A first group of wallets buys the memecoin with the stolen funds.
• A second group sells the tokens and recovers the paired asset.

According to Elliptic, crypto wallets linked to the network conducted all sales of the six tokens and all purchases of five of them. None of the six memecoins have been traded since November 8.

Five creators were funded by a wallet that sold a previous token, two to thirteen minutes earlier. Each memecoin was sold within three hours after its creation, according to Elliptic.

$430,000: less than 0.01% of the loot

The $430,000 represents less than 0.01% of the $6.3 billion stolen, according to Gizmodo. Elliptic emphasizes a point: each step remains visible on the crypto blockchain. In other words, the technique does not hide the funds. It wastes the time of those tracking them.

A similar technique was even used after the Bybit hack in February 2025. At least $24 million passed through a token created on Tron.

Memecoins therefore constitute only part of the laundering. As of November 9, Elliptic counted more than 20,000 crypto wallets, 16 blockchains, and at least 36 services involved. Its tracking estimated:

• about $3 billion of funds still present in addresses linked to the theft;
• $2.85 billion in frozen assets.

These categories are distinct and should not be added together as recovered crypto funds.

Elliptic also estimates about $29 million in ETH passed through THORChain to bitcoin by the evening of November 4. The company expects a gradual conversion to bitcoin, then withdrawals via over-the-counter brokers over several months.

Certainly, memecoins weigh little compared to the total loot of Binance. However, they illustrate a multi-step laundering where the transparency of the crypto blockchain does not guarantee immediate identification of beneficiaries. It remains to be seen if the unlaundered billions will follow the same path.