A monkey, a duck and Elon Musk: North Korean hackers launder Binance loot in an unexpected way

To sell off the $6.4 billion stolen from Binance, North Korean hackers found a rather unexpected trick. The thugs have in fact created their own memecoins, parody cryptocurrencies, and they use them massively to cover their tracks. The memecoins used by hackers include monkeys, a duck and Elon Musk.

The biggest heist in the history of cryptocurrencies is far from over. Ten days after the Binance hack, North Korean hackers continue to launder their loot on the blockchain. According to the latest report from Elliptic, a company specializing in blockchain analysis, hackers are now making their own memecoins in an attempt to evade investigators and law enforcement. Often bearing the likeness of animals or celebrities, these cryptocurrencies are based solely on jokes, like the famous Dogecoin.

“Most people think of memecoins as humorous tokens whose price rises and falls with the hype. North Korean launderers have found a completely different use for them: they create tokens that no one else wants to buy, and use them to hide the movement of stolen funds,” explains Tom Robinson, co-founder and scientific director of Elliptic, in the report.

North Korea’s launderers are creating their own meme coins to move funds stolen from Binance.

Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went into a liquidity pool through one set of wallets and came out through another, so no transfer links the two directly. About 117,000 NEAR (around $430,000) passed through the six tokens before they were abandoned.

Almost nobody outside the laundering network bought them. They exist only to put a pool between the stolen funds and the next wallet.

The trail can still be followed on-chain. For compliance teams, funds arriving from a liquidity pool are not clean by default, especially when the token is only days old. @tomrobin explains how the technique works and the warning signs to screen for: https://t.co/Q4VtlIGlFp

As a reminder, cybercriminals stole $6.43 billion in cryptocurrencies from Binance on the evening of October 29. In the space of four hours, the hackers, identified as the TraderTraitor gang by the FBI, siphoned several wallets from Binance. As soon as the theft was committed, the pirates began to launder the money by increasing the number of transfers on blockchain networks. Some of the loot was converted into , like Tether’s USDT.

Machine-translated from French