# North Korean Launderers Mint Their Own Memecoins on NEAR to Move Binance Hack Proceeds, Elliptic Says

The route moved about 117,000 NEAR, worth roughly $430,000, and Binance founder Changpeng Zhao acknowledged that staff skipped basic security rules before the $6.3 billion theft.

- Published: 2026-11-10T05:42:11.659Z
- Canonical: https://polylog.news/crypto/2026-11-10/north-korean-launderers-mint-their-own-memecoins-on-near-to
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/business/2026/11/09/north-korean-hackers-are-creating-memecoins-to-wash-loot-from-usd6-3-billion-binance-hack), [Bitcoin Magazine](https://bitcoinmagazine.com/news/north-korea-meme-coins-binance-hack), [Polylog editors](https://polylog.news), [Rekt News](https://www.rekt.news/), [Al Jazeera](https://aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist), [MLex](https://www.mlex.com/mlex/financial-crime/articles/2544401/binance-says-6-3bn-hack-came-through-employee-s-laptop), [Khaleej Times](https://www.khaleejtimes.com/business/tech/binance-hack-fake-job-interview-compromise-computer), [Nextgov](https://www.nextgov.com/cybersecurity/2026/10/fbi-involved-response-63-billion-binance-hack-linked-north-korea/416946/)

The people laundering the proceeds of the Binance theft have started issuing their own tokens. According to [Elliptic](https://www.coindesk.com/business/2026/11/09/north-korean-hackers-are-creating-memecoins-to-wash-loot-from-usd6-3-billion-binance-hack), launderers it links to North Korea created six memecoins on the NEAR blockchain between November 5 and 7. They then moved about 117,000 NEAR, worth roughly $430,000, through [liquidity pools they had built themselves](https://bitcoinmagazine.com/news/north-korea-meme-coins-binance-hack). A launderer who controls both sides of a pool can run stolen coins through a swap instead of a direct transfer, which makes the trail harder for automated screening to follow. French-language channels picked up the finding [the same day](https://t.me/GokuCryptoNews/21265).

The amount is small relative to the size of the theft. The Federal Bureau of Investigation (FBI) has [attributed the theft](https://aljazeera.com/news/2026/11/1/fbi-blames-north-korea-for-record-6-3bn-crypto-heist), which took place on or about October 29, to the North Korean group it calls TraderTraitor. The FBI blames the same group for the $1.5 billion Bybit theft in 2025. North Korea denies involvement, and President Donald Trump told reporters, "We don't know if it's North Korea." TRM Labs estimated that [$6.36 billion left Binance wallets](https://www.nextgov.com/cybersecurity/2026/10/fbi-involved-response-63-billion-binance-hack-linked-north-korea/416946/), most of it in about 20 minutes. Chainalysis estimated that about $2.8 billion had been frozen, and Binance said it set aside more than $6.34 billion of company funds to cover customer losses.

The intrusion relied on social engineering against a single employee. Binance said the attack [came through that employee's laptop](https://www.mlex.com/mlex/financial-crime/articles/2544401/binance-says-6-3bn-hack-came-through-employee-s-laptop). The [Khaleej Times](https://www.khaleejtimes.com/business/tech/binance-hack-fake-job-interview-compromise-computer) reports that attackers compromised the machine through a fake job interview. One report adds that the attackers then used an internal Binance artificial intelligence (AI) tool to reach other employees' computers, including an engineer's machine. No second source confirms that detail. Speaking at the Oxford Union, Zhao [acknowledged](https://t.me/GokuCryptoNews/21264) that Binance employees had not followed basic security rules and said the attack could have been prevented. [Rekt News](https://www.rekt.news/) has added the incident to its public list of crypto losses.

Each party gains from a particular reading of the facts. Attributing the theft to a state actor casts Binance as the victim of a nation-state attack. Zhao's admission instead places the failure inside the company's own operations. Elliptic sells tracing services and gains from showing that it can follow novel laundering routes. The on-chain facts support all three readings.

## What this means

The mechanism is a split in recoverability. Stablecoins have an issuer that can freeze them, and that is how most of the roughly $2.8 billion was locked. Native assets such as bitcoin, ether and NEAR have no issuer. They can only be stopped at venues that choose to screen, so the remaining proceeds will move toward permissionless pools and smaller chains whose front ends and validators have little compliance capacity. The Bybit theft of February 2025 is the precedent. The same group converted most of the ether to bitcoin within about two weeks, largely through the cross-chain swap protocol THORChain, whose node operators declined to block the flows. The likelier outcome is that the frozen share stops growing. The unfrozen remainder will move in small tranches over months through self-issued tokens and cross-chain swaps. Within weeks, US authorities will likely press the operators of smaller chains and decentralized exchanges to screen addresses the FBI has flagged. Binance customers face little direct loss, because Binance is covering it from its own capital. The lasting exposure is to exchanges' operational security and to the governance of chains that become laundering routes. This read is wrong if the large unfrozen holdings move in bulk to a centralized venue that freezes them, or if law enforcement announces a large seizure of native assets.

## What to watch

- Whether NEAR ecosystem front ends or validators begin blocking the addresses Elliptic identified. A refusal would repeat the THORChain dispute and draw regulators toward the chain.
- Movement from the wallets holding the stolen bitcoin. A transfer to any regulated exchange would test whether the remaining proceeds can still be frozen.
- Any Binance disclosure on device and hiring-process controls. It would show whether the fix addresses the social-engineering vector Zhao described or only adds detection tools.