Hackers linked to North Korea have created cryptocurrency tokens featuring Elon Musk and cartoon characters to disguise transfers of funds stolen from Binance, blockchain investigators disclosed on Monday.Elliptic identified at least six memecoins used to move approximately 117,000 NEAR tokens, valued at $430,000, following the October 29 attack on the cryptocurrency exchange. Binance estimates the overall theft at $6.3 billion, but investigators have not suggested that the entire amount passed through the newly created tokens.
The findings, published on November 9, describe a laundering operation designed to make stolen cryptocurrency appear to be proceeds from ordinary speculative trading. The tokens were created between November 5 and 7 on the NEAR blockchain and traded through decentralised exchange liquidity pools.
One token displayed Musk beneath an “Elon 2028 President” banner. Others featured a monkey, duck, chimpanzee, fox and flaming badge. Elliptic stressed that there was no indication Musk was connected to the operation or had endorsed any of the tokens.
The mechanism involved two groups of cryptocurrency wallets. One group purchased newly minted memecoins using stolen NEAR, while another sold those tokens into the same liquidity pools and collected NEAR. The transactions avoided direct transfers between the wallets holding stolen assets and those receiving the proceeds.
Tom Robinson, Elliptic's co-founder and chief scientist, said the method could make receiving wallets resemble successful traders rather than participants in a theft. Nevertheless, the underlying transactions remained visible on public blockchains, allowing investigators to reconstruct the movements.
Elliptic said virtually all activity involving the six tokens came from wallets associated with the laundering network. Outside buyers accounted for less than 1% of trading in one token, while five attracted no independent purchases. None of the six had traded after November 8.
The researchers identified a further connection between the token launches. Five creators received funding from wallets that had sold an earlier token, sometimes only two to 13 minutes before the next token appeared. Each token cost approximately 25 NEAR, equivalent to about $90, to create.
The FBI attributed the Binance theft to TraderTraitor, a North Korean state-sponsored hacking operation, in an October 31 advisory. It urged cryptocurrency exchanges, decentralised finance services and other operators to block transactions involving identified addresses associated with the stolen assets.
North Korea has rejected the allegation. Kim Yo Jong, sister of leader Kim Jong Un, accused Washington of unfairly associating Pyongyang with international cybercrime and dismissed the accusation as politically motivated.
The scale of the underlying theft remains subject to differing valuations. Binance put losses at approximately $6.3 billion, while Elliptic calculated $6.43 billion and Chainalysis estimated roughly $6.4 billion, reflecting their assessments of assets transferred across multiple blockchains.
Binance has said it replenished most affected assets using company resources, while working with investigators and cryptocurrency businesses to restrict the movement of stolen funds. About $2.85 billion was frozen or intercepted, according to Elliptic's assessment, primarily involving stablecoins whose issuers can prevent transfers.
Elliptic identified roughly $3.13 billion remaining in attacker-controlled wallets linked directly to the theft, largely in bitcoin and ether. Unlike centrally issued stablecoins, those cryptocurrencies cannot be frozen by a token issuer, making recovery dependent on tracing, cooperation and interception at other points.
The exchange has described an intrusion involving compromised employees' computers and stolen credentials. Binance executives said attackers manipulated software and internal access after a prolonged effort targeting engineers, before initiating unauthorised transfers from internet-connected wallets.
The memecoin activity was not confined to NEAR. Elliptic also identified a homemade token on Tron on November 2 and a related technique involving thinly traded assets on Solana the following day. The company said the same broad approach appeared after the 2025 theft from Bybit.
Elliptic warned that receiving funds from a decentralised liquidity pool does not establish that the assets are legitimate. Its investigators highlighted newly created tokens, concentrated trading among a handful of wallets and separate groups of buyers and sellers as indicators requiring closer examination. Elliptic said the technique adds investigative delays rather than providing anonymity, because every swap is recorded and can be linked through wallet funding patterns and subsequent transfers.
About 11.8 million NEAR tokens stolen from Binance, valued by Elliptic at $43.7 million, had not moved when its analysis was prepared. The researchers said four token creators withdrew remaining liquidity from their pools on November 8.
Topics
Cryptocurrency