Crypto Laundering Techniques: The Role of Memecoins in Recent Hacks

Overview of the Hack on Binance

In late last month, Binance faced an unprecedented hacking incident, resulting in a loss of approximately $6.3 billion. The group allegedly responsible for this breach is known as TraderTraitor, which has links to North Korea. Following the incident, TraderTraitor has reportedly employed various strategies to launder the stolen cryptocurrency, with a notable focus on creating and utilizing memecoins.

Memecoins: A New Method for Laundering

A recent report from the blockchain analysis firm Elliptic highlights how TraderTraitor has been leveraging memecoins as a laundering mechanism. Their approach involves:

• Issuing a new token and establishing a liquidity pool paired with another cryptocurrency, such as NEAR or a stablecoin, on decentralized exchanges.
• Using a set of wallets to purchase the token with the stolen funds while employing a different wallet set to sell it back into the same liquidity pool.
• Ensuring that the transaction trail appears as normal trading activity, obscuring any direct connection between the buying and selling wallets.

According to Elliptic co-founder Tom Robinson, “The launderers’ tokens are made to be used once and thrown away. Nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set.”

Case Study: NEAR Blockchain Activity

Elliptic’s analysis provides a clear example from the NEAR blockchain, which has been termed a smart contract platform. Between late last week, a series of six tokens were created under names like FUK, MEILI, and SINU. Each token cost around $90 to create, incorporating typical memecoin branding. Approximately 117,000 NEAR, valued around $430,000, was transferred through these tokens.

The coins are a disguise: a baby monkey, a duck, a mock Elon campaign poster.
They make stolen funds look like trading profit – but every step is on-chain, and we traced it.

Full analysis:

— Tom Robinson (@tomrobin) November 9, 2026

Additional Laundering Methods

Elliptic also observed a homemade token on the Tron blockchain that was specifically created for laundering purposes. In another case on the Solana blockchain, stolen SOL was exchanged for existing low-traded tokens, avoiding the creation of new tokens altogether.

Indicators suggest that the NEAR tokens were exclusively designed for laundering, as the transactions involved were predominantly between wallets associated with the laundering group. Notably, five out of the six token creators were funded by a wallet that had sold a prior token just minutes before a new launch.

Impact of Laundering Techniques

While Memecoins represent a small fraction of the total crypto stolen—around $430,000 from NEAR equating to less than 0.01% of the total hack—it illustrates a concerning trend in how funds are laundered in the crypto space. This is not the first instance of North Korea employing memecoins for laundering, as Elliptic previously identified similar tactics during the $1.4 billion Bybit hack in February 2025.

Elliptic succinctly noted, “Every step of this technique is recorded publicly on the blockchain, and investigators can follow it. It does not hide the funds so much as slow down the people tracing them.”

A Multitude of Techniques at Play

According to Elliptic, TraderTraitor’s laundering activities extend far beyond just memecoins, involving over 20,000 wallets across 16 blockchains and utilizing at least 36 different services. Among these methods, cross-chain bridges, lending vaults, and privacy pools have been essential in obscuring the movement of funds.

Notably, THORChain, a cross-chain exchange frequently associated with North Korean hacking groups, played a significant role in moving around $1.2 billion from the Bybit hack. Currently, around 12,200 ETH, primarily derived from stolen SOL, has reportedly flowed through THORChain into Bitcoin.

Conclusion: The Ongoing Challenge

In conclusion, the rising trend of using memecoins for laundering stolen cryptocurrency emphasizes the need for rigorous monitoring and regulatory frameworks in the crypto industry. The complexities of these laundering operations—combined with the existing challenges in tracing and recovering stolen assets—demonstrate the sophisticated means employed by entities involved in corrupt activities in the digital currency space.