According to Elliptic, North Korean hackers issue meme tokens to convert stolen assets from Binance into apparent trading proceeds.

Modus operandi described by Elliptic

Elliptic reports that attackers purchase their own tokens using stolen cryptocurrency, then sell those tokens from different wallets to obscure fund flows.

Scale and costs

From 05.11 to 07.11, transfers tied to six meme tokens on NEAR amounted to about $430 000, the company notes.

The creation of each token cost roughly $90, suggesting a low technical barrier and limited upfront expenditure for this laundering method.

Broader footprint

Analysts also identified a similar pattern operating within the Tron network, indicating the technique spans multiple blockchains and token ecosystems.

How the scheme hides transfers

The scheme masks direct transfers by simulating ordinary market activity: attackers convert stolen funds into self-created tokens, then redistribute proceeds through trade-like movements.

Implications for tracing and compliance

Elliptic’s findings underscore challenges for on‑chain tracing and compliance teams, who must distinguish between genuine market trades and tokenized laundering operations.