Binance Hackers Create Elon Musk and Animal Memecoins to Move Stolen Crypto

Launderers of last month’s Binance theft created six meme tokens on the NEAR blockchain to move stolen funds, blockchain analytics firm Elliptic said on 9 November.

One token, MMLI, shows Elon Musk beneath an Elon 2028 President banner. The other five carry a monkey with a pink bow, a duck in front of a US flag, a chimpanzee, a fox and a flaming gold badge. Elliptic said there is no suggestion Musk has any connection to the tokens.

Binance says the 29 October attack hit about US$6.34 billion (AU$9.19 billion) in assets. About US$2.85 billion (AU$4.13 billion) of that has been frozen or intercepted, the exchange said on 3 November. Two days after the attack, the FBI attributed the theft to North Korea’s TraderTraitor group.

Related: Europe’s Largest Asset Manager Amundi Tokenises Stock Index Fund on Ethereum

Six Tokens, Six Pools

The tokens, named FUK, OLCCL, MEILI, MMLI, DABI and SINU, appeared between 5 and 7 November. Each token cost about 25 NEAR, around US$90 (AU$131), to launch and was paired with NEAR in its own liquidity pool.

One set of wallets paid stolen NEAR into a pool to buy its token. A second set sold the token back and withdrew the NEAR. Stolen funds never passed directly between the two sets, Elliptic said.

Wallets in the laundering network made every sale of all six tokens and bought every unit of five. Five of the six token creators were funded by a wallet that had been selling an earlier token minutes before launch. The proceeds of one token paid for the next.

Elliptic founder and chief scientist Tom Robinson wrote: “North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay.”

About 117,000 NEAR, around US$430,000 (AU$623,500), went through the six pools. Those pools have seen no trading since 8 November, when four creators pulled their remaining liquidity. Another 11.8 million NEAR from the theft, worth US$43.7 million (AU$63.4 million), has not moved yet, Elliptic said.

A Technique From the Bybit Hack

Elliptic first saw the method after hackers took about US$1.46 billion (AU$2.12 billion) from Bybit in February 2025. The Bybit launderers created a worthless token on Tron and paired it with a stablecoin in a pool. The launderers then used fresh wallets to swap out of the token, moving at least US$24 million (AU$34.8 million).

Elliptic spotted a worthless Tron token built to launder the Binance funds on 2 November. Rival tracing firm TRM Labs said it had found a self-minted Tron token in the Binance trace a day earlier.

Elliptic advised compliance teams not to treat funds from a liquidity pool as clean by default. Its warning signs include tokens only days old and pools traded by a handful of wallets.

Read more: French Bank Crédit Mutuel Arkéa Hit by Cyberattack, ZachXBT Claims Over US$133 Million Stolen