North Korean Hackers Launder Binance Stolen Funds via Meme Coins and DEX Liquidity Pools
TREE NEWS reports: Blockchain analytics firm Elliptic has identified a new money-laundering technique used by North Korean hackers to move funds stolen from Binance. The attackers are creating meme coins and exploiting decentralized exchange (DEX) liquidity pools to obfuscate the trail of the $6.4 billion haul from the 2022 BNB Bridge hack. Between November 5 and 7, the hackers used the NEAR network to conduct a series of transactions involving meme coins and DEX liquidity pools.
Methodology: Meme Coins as a Laundering Tool
The scheme involves creating a new meme coin, adding liquidity to a DEX pool, and then using the stolen funds to purchase the token at inflated prices. This effectively transfers value from the stolen assets into the meme coin, which can then be sold or moved across chains. The use of meme coins—often with low liquidity and high volatility—makes it difficult for investigators to distinguish between legitimate trading activity and laundering. DEX liquidity pools, which operate without centralized oversight, further obscure the origin of funds.
Elliptic’s analysis indicates that the hackers have been experimenting with various chains and protocols to evade detection. The NEAR network, known for its low fees and fast transactions, has become a preferred route for moving funds between chains. The use of meme coins adds an extra layer of complexity, as these tokens often have limited trading history and can be easily manipulated.
Implications for the Crypto Industry
This development highlights the growing sophistication of North Korean hacking groups, which have stolen billions of dollars in crypto assets to fund the regime. It also underscores the vulnerabilities inherent in decentralized finance (DeFi) protocols, particularly DEXs, which lack the compliance controls of centralized exchanges. While DEXs offer users greater control over their assets, they also provide an easy avenue for money laundering.
Regulators and law enforcement agencies are increasingly focusing on DeFi as a potential vector for illicit finance. The Financial Action Task Force (FATF) has called for stricter controls on DeFi platforms, and the U.S. Treasury has sanctioned several mixing services and DEXs allegedly used by North Korean hackers. However, the decentralized nature of these platforms makes enforcement challenging.
Forward-Looking Perspective
The crypto industry must respond to these evolving threats with enhanced monitoring and collaboration. Blockchain analytics firms like Elliptic are developing tools to detect suspicious patterns, but the cat-and-mouse game continues. Exchanges and DEXs should implement stronger know-your-customer (KYC) and anti-money-laundering (AML) procedures, even if it means sacrificing some decentralization. Additionally, cross-chain interoperability protocols need to be designed with security and traceability in mind.
As North Korean hackers refine their techniques, the industry must stay one step ahead. The use of meme coins and DEX liquidity pools is a reminder that illicit actors will exploit any weakness in the system. Only through collective action and innovation can the crypto ecosystem remain safe and trustworthy.
