North Korean Launderers Mint Their Own Memecoins on NEAR to Move Binance Hack Proceeds, Elliptic Says

The people laundering the proceeds of the Binance theft have started issuing their own tokens. According to Elliptic, launderers it links to North Korea created six memecoins on the NEAR blockchain between November 5 and 7. They then moved about 117,000 NEAR, worth roughly $430,000, through liquidity pools they had built themselves. A launderer who controls both sides of a pool can run stolen coins through a swap instead of a direct transfer, which makes the trail harder for automated screening to follow. French-language channels picked up the finding the same day.

The amount is small relative to the size of the theft. The Federal Bureau of Investigation (FBI) has attributed the theft, which took place on or about October 29, to the North Korean group it calls TraderTraitor. The FBI blames the same group for the $1.5 billion Bybit theft in 2025. North Korea denies involvement, and President Donald Trump told reporters, "We don't know if it's North Korea." TRM Labs estimated that $6.36 billion left Binance wallets, most of it in about 20 minutes. Chainalysis estimated that about $2.8 billion had been frozen, and Binance said it set aside more than $6.34 billion of company funds to cover customer losses.

The intrusion relied on social engineering against a single employee. Binance said the attack came through that employee's laptop. The Khaleej Times reports that attackers compromised the machine through a fake job interview. One report adds that the attackers then used an internal Binance artificial intelligence (AI) tool to reach other employees' computers, including an engineer's machine. No second source confirms that detail. Speaking at the Oxford Union, Zhao acknowledged that Binance employees had not followed basic security rules and said the attack could have been prevented. Rekt News has added the incident to its public list of crypto losses.

Each party gains from a particular reading of the facts. Attributing the theft to a state actor casts Binance as the victim of a nation-state attack. Zhao's admission instead places the failure inside the company's own operations. Elliptic sells tracing services and gains from showing that it can follow novel laundering routes. The on-chain facts support all three readings.