North Korean hackers are out here spawning their own meme coins to shuffle that stolen stash from the Binance hack according to blockchain analytics firm Elliptic.
Their Sneaky Binance Laundering Trick 😈
Elliptic flagged the activity on Tron and NEAR plus a similar method on Solana. The process involves creating a token pairing it with a legit crypto like NEAR or a stablecoin and tossing it into a liquidity pool on a dex. The attackers then use one set of wallets to buy the fresh token with stolen funds while a separate crew of wallets sells those tokens back into the pool grabbing the original crypto. This slips the liquidity pool right between the wallets making it tougher to link the cash flowing in with what comes out right away. The blockchain analytics firm said it first spotted the method while tracking funds stolen from Bybit in 2025. In that case North Korean launderers created a worthless token on Tron and used it to move at least $24 million through a liquidity pool. The same approach popped up again right after the Binance theft. On November 2 Elliptic identified a newly created token on Tron that looked launched just for laundering. The next day stolen Solana (SOL) got swapped for wrapped and thinly traded tokens before turning into USDC and jumping to other blockchains. The activity on NEAR gave the clearest proof of the method. Between November 5 and 7 the attackers whipped up six tokens named FUK OLCCL MEILI MMLI DABI and SINU. Each paired with NEAR in its own liquidity pool. Creating a token cost around 25 NEAR or roughly $90. Those six tokens moved about 117000 NEAR worth around $430000. According to Elliptic the wallets buying these tokens pulled funding straight from stolen NEAR. Almost the same amount later slipped out through separate wallets and much of it converted into stablecoins or crossed a bridge. The transaction patterns showed these tokens were not getting traded by regular investors at all. Wallets tied to the laundering op handled nearly all the buys and sells. Three tokens DABI MMLI and SINU each had just one buying wallet and one selling wallet. They traded heavy right after launch then got ditched. None of the six has seen more action since November 8. 🖤
But The Trail Still Lingers Tho 🕵️♀️
Elliptic also found that proceeds from older tokens funded the newer ones linking the whole six token scheme. The method does not wipe the transaction trail off the blockchain though. Investigators can still follow the funds but all the extra swaps and wallets just drag things out. At around $90 per token whipping up fresh ones stays cheap af. This lets the attackers repeat the cycle with new tokens over and over. The $430000 moved through those six NEAR tokens is just a tiny slice of the stolen loot. Elliptic estimates around 11.8 million NEAR worth about $43.7 million still sits unmoved. The firm warned crypto exchanges and compliance teams not to auto treat funds from liquidity pools as clean. New tokens pools with super few wallets and accounts funded right before trading could all scream laundering vibes. 🌑💀👀🔥🖤😼🌙
Just another echo from the void by iconofsin.eth 💖
