North Korean cybercriminals are turning the chaotic world of meme coins into a sophisticated tool for scrubbing stolen wealth. According to a recent report from blockchain analytics firm Elliptic, launderers tied to the massive Binance heist are minting their own worthless tokens to disguise the movement of illicit funds. By pairing these homemade coins with legitimate assets in decentralized exchange liquidity pools, the thieves can break the direct digital paper trail between their original theft wallets and the final destinations where the money is collected.
The operation relies on a deceptive cycle where criminals launch a token, pump it with stolen cryptocurrency via one set of wallets, and then sell those tokens through entirely different accounts. This makes the resulting withdrawals look like standard trades from lucky investors rather than organized crime moving loot. In one notable instance on the Near network, researchers found half a dozen disposable tokens featuring absurd imagery ranging from ducks and monkeys to an unauthorized likeness of Elon Musk campaigning for president in 2028.
While some of these tokens bore crude or playful names designed to blend into typical retail speculation, their purpose was purely clinical. Each coin cost roughly ninety dollars to create and lived for only a few days before being abandoned once several hundred thousand dollars had been cycled through them. These maneuvers are part of a larger strategy employed by groups like TraderTraitor, who previously used similar tactics during the fallout of a billion dollar theft from Bybit.
Despite the ingenuity of using fake currencies as buffers, experts warn that this method does not actually make the money invisible. Because blockchains are public ledgers, firms like Elliptic can still trace the flow of assets; however, adding these layers creates friction that slows down investigators and gives hackers precious time to move funds before they are flagged globally. With billions of dollars from previous hacks still sitting in dormant wallets, security teams are being urged not to trust any funds emerging from suspicious liquidity pools involving newly minted tokens.