State-sponsored hacking groups have added a peculiar new tactic to their illicit financial operations following last month's staggering $6.3 billion Binance heist. According to a new report published Monday morning by blockchain analysis firm Elliptic, the North Korea-associated group TraderTraitor has begun creating custom memecoins to launder stolen cryptocurrency through decentralized exchanges.
The laundering mechanism relies on liquidity pools to obscure the trail of illicit funds. Launderers create a brand-new token and pair it with another crypto asset like a stablecoin or NEAR on a decentralized exchange. One set of wallets controlled by the hackers buys the token using stolen funds, while a separate set of wallets sells the token back into the same pool and withdraws the paired crypto asset. Because the liquidity pool sits squarely between the transfers, no funds move directly from the buying wallets to the selling wallets, allowing the transactions to mimic ordinary traders selling tokens at a profit.
Key takeaways
- TraderTraitor allegedly laundered funds through memecoins after hacking Binance for $6.3 billion.
- Hackers created at least six tokens on the NEAR blockchain with names like FUK, MEILI, and SINU.
- Memecoin branding included a monkey with a pink bow and an Elon Musk campaign poster.
- The NEAR-based laundering accounted for about 117,000 NEAR, worth roughly $430,000.
The NEAR Blockchain Operation
The clearest example of this memecoin laundering technique emerged on the NEAR blockchain, a smart contract platform that markets itself as infrastructure for AI agents. Over three days late last week, the hackers launched at least six tokens costing about $90 apiece to create. These assets featured classic memecoin branding, including a monkey wearing a pink bow and an image of Elon Musk displayed beneath an "Elon 2028 President" banner.
Approximately 117,000 NEAR, worth around $430,000 at the time of reporting, passed through these six tokens. Elliptic co-founder Tom Robinson noted that the tokens are designed to be used once and discarded, with no outside buyers participating and prices set entirely by the launderers. Elliptic noted multiple indicators proving the tokens existed solely for laundering, such as internal wallets managing every sale across all six tokens and buying every unit of five of them. Five of the token creators were funded by a wallet that sold an earlier token moments before a new one launched, meaning the proceeds of one token directly funded the creation of the next. Each token also compressed at least three-quarters of its trading volume into a single day, with zero trading activity recorded since Sunday.
Broader Laundering Techniques and Destination Assets
While the memecoin strategy provides a creative smokescreen, it accounts for a tiny fraction of the total loot from the Binance hack. TraderTraitor heavily relies on a multi-layered approach involving thousands of wallets across numerous blockchains. Elliptic reports that the broader laundering effort has spanned more than 20,000 wallets across 16 blockchains and at least 36 services, including cross-chain bridges, lending vaults, and Privacy Cash pools.
Roughly 7,000 ether, valued at approximately $15 million, was funneled into Tornado Cash. Cross-chain exchange THORChain also played a central role, handling roughly 12,200 ETH worth $29 million that was mostly converted from stolen Solana into bitcoin by Wednesday evening. Ultimately, bitcoin remains the primary destination for these laundering efforts. Elliptic estimates that roughly 3,000 bitcoin worth $225 million now sits in new bitcoin addresses, with about 130 bitcoin passing through Wasabi-style CoinJoin transactions. However, not all stolen assets were accessible; Tether, Circle, and other entities quickly froze roughly $3 billion of the stolen crypto, with Tether freezing stolen USDT on Ethereum just 37 minutes after it landed in the attacker's wallet.
Comments