North Korean Hackers Use Elon Musk Meme Coin to Clean Binance Loot

North Korean cybercriminals are now creating meme tokens to launder stolen cryptocurrency. One of these tokens features an image of Elon Musk with a political tagline, according to blockchain analysis firm Elliptic, which released findings on Monday.

Elliptic stated that Musk is not connected to these tokens. Approximately 117,000 NEAR Protocol (NEAR) tokens, valued at around $430,000 by Elliptic's calculation, have moved through six custom-made coins. Elliptic advises exchanges that have already processed funds from these trades to re-examine them.

Meme Coin Valued at $90 Used to Conceal Stolen Assets

The funds originate from the $6.4 billion theft in October, which the FBI attributed to North Korea.

Launching each counterfeit token cost roughly $90. The criminals paired each token with NEAR in a liquidity pool, an automated trading mechanism on a decentralized exchange.

One group of wallets acquired the token using stolen NEAR. Another group then sold it back, receiving NEAR in return.

Funds were never directly moved from the thief to the recipient. On the blockchain, the sellers appeared to be fortunate traders.

The tokens adopted American imagery. One logo featured a duck in front of a US flag. Another displayed the Musk banner. Elliptic did not specify which of the six tokens used the Musk image.

Can Exchanges Detect the Money Laundering?

Very few external parties engaged with these coins. Outsiders purchased a small portion of one token, less than 1% of its trading volume.

Each coin experienced heavy trading activity for a few hours before fading. Profits from one coin funded the launch of the next.

“It does not hide the funds so much as slow down the people tracing them,” read an excerpt in the Elliptic blog, citing Tom Robinson.

Launderers must convert their assets to cash before their wallet addresses are added to blocklists. The same technique facilitated at least $24 million after the 2025 Bybit hack.

Why $430,000 Could Be Just the Beginning

Approximately 11.8 million stolen NEAR tokens, worth $43.7 million by Elliptic's estimate, remain untouched. The meme coin method has processed less than 1% of that amount so far.

Elliptic emphasized that the launch platform, the exchange, and the wallet application are not at fault. The launderers used these services in the same way any ordinary customer would.

This places the responsibility on the entity that receives the money. Elliptic recommends that deposits already approved by exchanges be reviewed again as its blocklist expands.