Overview of the Technique

North Korean operatives are reportedly leveraging a novel method for laundering stolen cryptocurrencies by creating their own worthless tokens. This technique facilitates the movement of illicit crypto assets through decentralized exchange liquidity pools, thereby obscuring direct transactions between wallets linked to stolen funds and those receiving them.

The recently analyzed $6.4 billion Binance case illustrates this method, primarily utilizing the Tron and NEAR blockchains, with a similar strategy observed on Solana. Previous reports, notably from Elliptic, indicated this laundering technique’s emergence during the Bybit hack in 2025.

While the total amounts laundered using this technique are currently minimal—approximately 117,000 NEAR (valued at around $430,000)—its cost-effective nature raises concerns over potential larger volumes being processed similarly in the future.

Characteristics of the Meme Tokens

Meme tokens are often seen as humorous additions to the crypto landscape, typically tied to internet culture or pop phenomena. However, the tokens crafted by North Korea’s launderers serve a distinctly different function: they are designed for single-use and lack any intrinsic value. In this scenario, these tokens act as vessels—allowing stolen funds to enter one side of a liquidity pool and exit on the other side without revealing their origin.

The visual elements of these tokens often mimic popular meme tokens, featuring whimsical logos and playful names. For example, tokens like FUK and SINU adopt familiar meme styles, incorporating humor and pop culture references, further helping them evade scrutiny.

Mechanics of the Laundering Process

The laundering process using these tokens unfolds in several key steps:

1. Create a Token: Launderers utilize readily available public tools to launch new tokens on the specified blockchain.
2. Open a Liquidity Pool: They establish a liquidity pool pairing the freshly minted token with a legitimate asset (like NEAR or a stablecoin).
3. Deposit Stolen Funds: Stolen crypto is funneled into this pool in exchange for the newly minted token.
4. Withdraw Real Assets: The launderers then sell the token back into the same pool, withdrawing genuine assets from the other end.

This process ensures that stolen funds never move directly from one wallet to another, disguising their origin effectively.

Historical Context: Observations of Similar Techniques

This laundering method first gained attention during the investigation into the Bybit hack, with the launderers creating a worthless token on the Tron network. They used a similar strategy shortly after the Binance heist. For instance, North Korean operatives launched tokens on various platforms, including a series of meme tokens on NEAR starting from November 5, where they created at least six new tokens in quick succession.

Indicators of Token-Based Laundering

Analysis indicates that the tokens were specifically engineered for laundering operations. Several factors point to this conclusion:

• The absence of trades from outside wallets, as all transactions originated from the laundering network.
• Tokens were funded using proceeds from prior token sales, forming a chain of laundering.
• Every token was swiftly abandoned after use, with a significant portion of its trading activity occurring almost immediately following its creation.

Consequences for Compliance Teams

For compliance and regulatory teams, it is crucial not to assume that funds sourced from a liquidity pool are free from illicit activity—particularly when involving newly launched tokens. Certain warning signs can signal potential laundering activities:

• New tokens created in a short timeframe.
• Liquidity pools characterized by minimal wallet trading activity.
• Wallets consistently seen only buying or selling the same token.
• New wallets receiving funding just prior to engaging in token trading.

Firms are encouraged to scrutinize the origins of assets in liquidity pools, and to employ robust monitoring tools to continually assess wallet activity against known laundering metrics.