The Memecoin Hop: Laundering the Binance Hack Through Throwaway Tokens

Everyone thinks memecoins are only good for gambling. The $6.3B Binance hack just exposed a second use: laundering.

Funny arc if you think about it. They started as actual jokes: a dog on a coin and people laughing. Then the joke became a casino and fried a whole cycle's dopamine receptors. Now we learn the same launch button doubles as a laundering tool.

According to Elliptic, launderers tied to North Korea minted six tokens on NEAR between Nov 5 and 7 and pushed stolen funds through them. Scroll down and follow the money.

2013

A joke

A dog on a coin, and people laughing.

Last cycle

A casino

The same joke, with a slot lever on the side.

Nov 2026

A laundry

The same launch button, doing a third job.

Follow the money

Scroll. The thread moves with you.

Binance

$6.3BHACK

Oct 29 · The heist

$6.3B leaves the exchange

Binance disclosed a security incident that hit about $6.3B in client assets. It is the largest crypto theft on record, and Binance says the FBI has linked it to North Korea.

1 strandMost of what left the vault went elsewhere. This page follows one thin strand of it.

Intermediate accounts

The slice

A strand of stolen NEAR

Part of the loot was NEAR. From the main stolen-NEAR wallet it moved through intermediate accounts into a set of fresh wallets.

11.8M NEARabout $43.7M, had still not moved at all when Elliptic published.

12Meanwhile

Create a token. Open a pool.

While the money is on its way, someone presses a button. A public launch tool mints a brand new memecoin for about 25 NEAR, roughly $90, and pairs it with NEAR in its own liquidity pool.

No code to write. Nobody to ask.

Public launch tool

Each press costs about 25 NEAR, roughly $90. Go on, press it.

Wallet set A

3Buy

One set of wallets buys the token

The buying wallets pay stolen NEAR into the pool and get the new token back. On paper it is just a trader aping into a fresh memecoin.

~117,000 NEARwent in across the six tokens. About $430K.

MEMECOIN

One pool · token / $NEAR

The hop

The pool sits in between

This is the whole trick. The stolen NEAR goes into the pool on one side and comes out on the other, and the two sets of wallets never touch each other. In Elliptic's words, the pool sits in between.

What a tracer sees

Set A → PoolNEAR in

Pool → Set AToken out

Set B → PoolToken in

Pool → Set BNEAR out

Set A → Set BNever

Wallet set B

4Sell

A second set sells it back

Different wallets sell the same token into the same pool and take the NEAR out. Nobody else was trading. Per Elliptic, the launderers made every sale of all six tokens.

<1%of one token's volume came from outsiders. The other five had none.

$NEAR

Now it looks like a trade

Out

Clean-looking NEAR walks away

Almost the same amount left the collecting wallets, much of it swapped into stablecoins or sent to a cross-chain bridge. To a quick look, that is somebody cashing out of a memecoin.

$430Kthrough six tokens, in three days.

Nov 8

Then the lights go out

None of the six has traded since Nov 8. That afternoon the creators of four of them pulled whatever liquidity was left.

FUKborn Nov 5lived 3 days
OLCCLborn Nov 6lived 2 days
MEILIborn Nov 6lived 2 days
MMLIborn Nov 6lived 2 days
DABIborn Nov 6lived 2 days
SINUborn Nov 7lived 1 day

Scale

Yes, $430K is nothing

Against $6.3B it does not even register. It is about 1% of the stolen NEAR that has not moved yet.

The size is not the story. Elliptic's point is that the technique is cheap and could carry far larger sums. A route that costs $90 to open does not need to be big to matter.

The Binance theft$6.3B

Stolen NEAR that has not moved$43.7M

Pushed through the six memecoins$430K

Each bar is a sliver of the one above it, blown up to full width. The sliver is drawn to scale.

Not new

The trick is older than this hack

I assumed this had been done before, and it has. Elliptic first saw it in the laundering of the 2025 Bybit hack, when at least $24M went through a worthless token paired with a stablecoin on Tron. In the Binance case it showed up on Tron and Solana before it ever reached NEAR.

2025 · Bybit
A homemade token on Tron
At least $24M moves through it.
Nov 2
Tron again
A worthless token is created for the Binance funds.
Nov 3
Solana
Stolen SOL is swapped into thinly traded tokens.
Nov 5 to 7
NEAR, six times
About 117,000 NEAR, roughly $430K.
Nov 8
Silence
No trades since. Four creators pull liquidity.

What changed is the spotlight. A hack this loud gets every hop traced and published.

And traced is the right word. Every step sits on a public chain, and Elliptic says the technique slows investigators down rather than hiding the funds. That is enough. Launderers do not need to be invisible. They need a head start before the wallets get flagged.

The real problem

A mixer is a fixed target. This is not.

A mixer is a known set of contracts you can flag. This is a fresh contract every time, on any chain with a launchpad, alive for a few days, then gone. Try to keep up.

A mixer

One address list

MIXERknown contracts

Everything that wants to hide goes through the same door.

Flags 0 · Live 1

A token factory

A new door every time

FUKlive pool

One throwaway token, one pool. Flag it and see what happens.

Flags 0 · Live 1

The mixer is the token factory itself.

What comes next

The fight moves to the launch button

The timing is rough too. Regulators are looking for any opening to step into crypto right now, imo. A headline tying memecoins to crypto's biggest heist ever hands them one.

To me, that suggests the next compliance fight lands on launchpads and pool deployment, far away from privacy tools. Of course, that part is my guess.

But if you run a launchpad, are you ready for the day a regulator calls your product laundering infrastructure?

Sources and notes Figures and mechanics come from Elliptic's report of Nov 9, 2026, North Korea is minting meme coins to launder the Binance hack. Elliptic puts the theft at $6.4B; Binance's own figure is about $6.3B. The report does not say how many wallets were in each set, so the five drawn here are only a picture. The regulatory read is mine, not Elliptic's.

✦ ✦ ✦