North Korean hackers use memecoins to launder loot from Binance hack

The North Korean hackers behind the massive hack at Binance are trying to whitewash their stolen crypto in a striking way. At the end of October they looted 6.3 billion dollars and since then they have been looking for ways to keep the money out of the sight of researchers.

Research by blockchain analytics firm Elliptic shows that the hackers created six memecoins to launder stolen crypto. Between November 5 and 7, they moved about 117,000 near tokens with a combined value of about $430,000.

The hackers gave their memecoins striking names. For example, a crypto coin appeared with an image of Elon Musk and the text ‘Elon 2028 President’. Other coins were given names that referred to dogs, a popular theme within the world of memecoins.

The new crypto coins were not intended to attract real investors. They were mainly used to carry out transactions with which the hackers wanted to give their stolen money a legitimate origin.

The hackers ensured that their memecoins could be traded on a decentralized crypto exchange at NEAR. They then used different crypto wallets to trade among themselves.

With one wallet, they bought memecoins with stolen NEAR. Via another wallet, they sold those same coins again for NEAR.

That way, it seemed as if the money had been earned in a legitimate way, when in reality it was stolen crypto.

“The money launderers made six crypto coins and traded exclusively with themselves. As a result, the stolen funds look like trading proceeds,” says Elliptic co-founder Tom Robinson.

According to Elliptic, almost all of the trading volume came from wallets involved in the money laundering operation. For one of the memecoins, less than one percent of the trading volume came from external investors. Since yesterday, trading in all six crypto coins has stopped.

The US Federal Bureau of Investigation holds the North Korean hacking group TraderTraitor responsible for the massive Binance hack of 29 October.

The hackers had been preparing their attack for months. Through a fake job interview, they managed to install malicious software on a Binance employee's computer. According to security researchers, the attackers may have had access to the internal systems for as long as eight weeks before they struck.

Meanwhile, Binance and blockchain researchers are trying to recover as much of the stolen crypto as possible. Meanwhile, about $2.85 billion of the loot has been frozen or intercepted, representing about 44 percent of the total amount.