Twenty Minutes to Steal It. Meme Coins to Wash It.
It took North Korea-linked hackers twenty minutes to steal as much as $6.4 billion in cryptocurrency from Binance, the world’s largest crypto exchange. Washing it is taking a little longer — and the laundry method is almost insulting in its simplicity: they are minting joke coins with Elon Musk’s face on them.
According to blockchain analytics firm Elliptic, the hackers are laundering the stolen funds through newly created meme coins on the NEAR blockchain. Six tokens so far, with names like “FUK” and “SINU” and logos featuring chimpanzees, a fox, a duck in front of a US flag, a monkey wearing a pink bow, a flaming gold badge, and Musk himself under an “Elon 2028 President” banner.
The October 29 attack was months in the making, according to researchers. TRM Labs, another blockchain analysis firm, said several features of the heist matched earlier attacks linked to North Korea — including the 2025 hack of crypto exchange Bybit, which the FBI attributed to Pyongyang. Now the laundering phase has begun, and it looks like a joke. It is not.
The wash: worthless coins as containers
The method works because a meme coin is, by design, worthless. Anyone can create a new crypto token, and most meme coins are built around a joke, an animal, or a celebrity, traded on hype rather than any underlying use. Elliptic calls the launderers’ tokens “containers”: the hackers create their own worthless token and use it to move stolen crypto through a decentralized exchange liquidity pool, so no funds pass directly from the wallets holding the stolen assets to the wallets that receive them.
Stolen funds go in on one side of the pool and come out on the other, carried by a token nobody outside the operation buys and whose price is whatever the launderers choose to set. “The launderers’ tokens are made to be used once and thrown away,” the researchers explain. Each token is a single-use envelope — and at about $90 each to create on NEAR, the launderers can make as many as they like.
Why it works — and why it doesn’t hide them
The disguise is the point. A wallet whose history shows trades in a new meme coin looks like a speculator, not a launderer — unless someone checks where the money came from. That is the observation of Tom Robinson, Elliptic’s chief scientist and co-founder. One more short-lived token with a cartoon image or a Musk logo attracts almost no attention.
But the funds remain trackable. The tokens do not hide the money so much as slow down the investigators tracing it. “Each extra hop takes time to unpick, and laundering is a race to move funds before they are flagged,” Robinson said. So far, about $430,000 of stolen funds has passed through the homemade meme tokens on NEAR — a small amount next to $6.4 billion, but the technique is cheap to run and can carry far larger sums.
What it means
Binance said last week it has recovered around 98% of the assets stolen in the breach, and the company promises to cover all losses linked to the attack. The remaining amount may take longer to source. Beyond the money, the breach is likely to have wider ramifications for crypto, which was already under pressure from higher US interest rates and softer demand from exchange-traded fund buyers.
The laundering scheme is also a reminder that the crypto crime playbook keeps evolving faster than the defenses. The US recently cut the MEXC exchange off from the American financial system over $16 billion in illicit transactions, and an AI agent breached Chainalysis and exposed every user’s credentials. The investigators chasing this money are good — but every extra hop buys the launderers time, and time is the one thing a $6.4 billion heist can afford.
Somewhere in the laundering chain, a wallet holding a coin called “FUK” with a chimpanzee on it is moving money stolen from the world’s biggest crypto exchange. The joke is the camouflage. The blockchain never forgets — but it does make you wait.