TL;DR
- Blockchain analytics firm Elliptic identified six newly created memecoins used to disguise approximately $430,000 in stolen NEAR tokens linked to the $6.4 billion Binance hack.
- The tokens featured animal-themed branding and a fake Elon Musk presidential campaign reference, with no evidence connecting Musk to the scheme.
- Investigators identified similarities with laundering techniques used after the 2025 Bybit hack, when approximately $24 million moved through a homemade token.
The laundering operation linked to the $6.4 billion Binance hack has adopted an unusual strategy involving fake Elon Musk branding and animal-themed memecoins. According to blockchain analytics firm Elliptic, attackers connected to North Korea used decentralized trading mechanisms to make stolen cryptocurrency harder to track.
In a report published Monday, Elliptic revealed that approximately 117,000 NEAR tokens, worth around $430,000 at the time, passed through six newly created memecoins between November 5 and November 7. The activity demonstrates how permissionless blockchain infrastructure can serve legitimate financial innovation while also creating new challenges for transaction monitoring.
Binance Hackers Exploit Memecoin Liquidity To Disguise Transactions
The six tokens featured unconventional branding, including animal characters, an offensive ticker symbol and an image of Elon Musk accompanied by an “Elon 2028 President” slogan. Elliptic clarified that there was no indication Musk had any involvement in the operation.
The technique relies on decentralized exchange liquidity pools rather than direct transfers between wallets. One group of addresses purchases newly issued tokens using stolen NEAR, while separate wallets sell those assets through liquidity pools and receive NEAR in return.
This structure creates additional transaction layers between the original stolen funds and the wallets collecting the proceeds. To outside observers, the receiving addresses can resemble ordinary traders completing profitable transactions.
Elliptic explained that the funds did not move directly from purchasing wallets to collecting wallets. Instead, liquidity pools acted as intermediaries, complicating the process of connecting both sides of the operation.
The six memecoins have since been abandoned. Investigators also identified movements into stablecoins and cross-chain bridges, indicating that the operation extended beyond the initial token swaps.
Bybit Hack Provides A Blueprint For Crypto Laundering
Elliptic identified similarities with the February 2025 Bybit security breach, when approximately $1.5 billion in Ethereum was stolen. Following that incident, attackers reportedly moved around $24 million through a custom token paired with a stablecoin on the Tron network.
The Binance investigation also uncovered comparable activity involving existing low-liquidity tokens on Solana. These findings suggest that criminals are adapting familiar techniques across multiple blockchain ecosystems.
However, additional transaction layers do not make cryptocurrency movements invisible. Public blockchains preserve transaction records, allowing analysts to reconstruct transfers and identify suspicious wallet relationships.
The Binance incident also involved compromised developer software, a fraudulent job interview and manipulated AI-related tools. The FBI attributed the attack to North Korea, according to Binance’s previous disclosures.
