Binance Hack: Hackers Launder Money Through 6 Meme Coins, Here's How They Do It

The Binance hack case is drawing attention again after blockchain investigators uncovered an unusual method used by the hackers to disguise stolen funds. A hacking group linked to North Korea allegedly created six meme coins on the NEAR network and used them to obscure the movement of approximately 117,000 NEAR, worth around US$430,000.

The findings, disclosed on November 9, 2026, add another chapter to the Binance hack involving approximately US$6.4 billion in late October. Rather than simply transferring funds from one wallet to another, the perpetrators used trading activity on decentralized exchanges (DEXs) to make the flow of money appear to be ordinary crypto transactions.

Key Takeaways

• Hackers linked to North Korea allegedly created six meme coins to conceal funds stolen in the Binance hack.
• Approximately 117,000 NEAR, valued at US$430,000, was identified as flowing through these tokens between November 5 and 7, 2026.
• The use of DEX liquidity pools complicates fund tracing, although every transaction remains recorded on the blockchain.

Binance Hack 2026: How Did the Incident Begin?

The Binance hack on October 29, 2026 was recorded as one of the largest cryptocurrency thefts in history. The attack resulted in the loss of various digital assets worth approximately US$6.4 billion in total.

Following the incident, investigators began tracking the stolen funds. Their findings revealed extensive transaction activity involving thousands of wallets across multiple blockchain networks.

By early November, more than 20,000 wallets had been identified within the transaction network associated with the hack. Activity spanned 16 blockchains, with at least 65,000 transactions involving various crypto services.

Among the many asset movements, investigators noticed an unusual trading pattern. Several wallets linked to the stolen funds were trading newly created meme coins.

These tokens were not developed as long-term crypto projects. Instead, trading activity was extremely short-lived and dominated by interconnected wallets.

This raised suspicions that the meme coins had been deliberately used as intermediaries for crypto money laundering.

Read also: Ledger Hardware Wallet Allegedly Modified: Crypto Users Urged to Stay Alert

Six NEAR Meme Coins Used to Disguise the Funds

Meme coins are usually associated with amusing characters, internet jokes, or community trends. Some can even become popular very quickly after attracting investor attention.

However, the six tokens involved in the Binance hack displayed a very different pattern.

The tokens were created on the NEAR network between November 5 and 7, 2026. Each had a typical meme-coin name and image but showed little meaningful community activity.

The investigation identified the following tokens:

The images varied widely, from cartoon animals to depictions of Elon Musk. However, there is no indication that the public figure was involved in issuing the tokens.

Another notable detail is the creation cost. Each token required only around 25 NEAR, or approximately US$90 at the time of the incident.

With such relatively low costs, the perpetrators could create new tokens without needing to maintain them for long.

The Tokens Were Active for Only a Few Days

All six tokens saw substantial trading activity shortly after their creation. However, that activity soon stopped, with no further trading identified since November 8.

Four token issuers even withdrew the remaining liquidity from their pools on the same day.

This pattern differs from typical crypto projects, which seek to attract users, build communities, and sustain trading activity.

In this case, the tokens were allegedly needed only while the assets were being moved.

How Did the Alleged Crypto Money Laundering Scheme Use Meme Coins?

Crypto money laundering has often been associated with transferring funds across numerous wallets or asset-exchange services. The Binance case shows that token trading activity can also be misused for similar purposes.

Investigators found that meme coins were used as transaction intermediaries. By involving DEX liquidity pools, the movement of funds did not appear as a direct transfer between the originating and receiving wallets.

At first glance, the activity resembled normal trading. There were token purchases, sales, and asset movements recorded on the blockchain.

However, a closer examination of the connections between wallets showed that many transactions originated within the same network. This pattern led investigators to view the activity as an attempt to conceal the source of the funds rather than genuine, organic trading.

Why Were Meme Coins Chosen?

One reason relates to the nature of the meme-coin market itself. New tokens appear almost every day. Many have no particular utility, trade briefly, and then fade from market attention.

Under those conditions, a new token with a cartoon image and brief trading activity might not immediately look suspicious.

Besides being easy to create, such tokens do not require an established ecosystem. The perpetrators could use them briefly before activity ceased.

That does not mean all newly created meme coins serve illegal purposes. The findings in this case were based on identified wallet connections, the origin of funds, and trading patterns.

Read also: CoinDCX Hack: 15.99 Million USDT Lost, Initially Described as a False Alarm

The Role of DEX Liquidity Pools in the Binance Hack

To understand why these transactions are difficult to trace, it helps to understand how liquidity pools work in crypto trading.

A liquidity pool is a collection of digital assets used to facilitate token swaps on a decentralized exchange. This mechanism allows users to swap assets without waiting for a direct counterparty to buy or sell.

This system is an important part of the decentralized finance (DeFi) ecosystem and is used legitimately by many investors. However, its open nature can also be exploited by parties seeking to make asset tracing more difficult.

In this case, liquidity pools served as intermediaries for trading involving stolen funds. As a result, the connection between sending and receiving wallets was less straightforward than in a typical crypto transfer.

Investigators must examine both the origin of assets entering the pool and the links between transactions after the assets leave it. For that reason, funds originating from a liquidity pool cannot automatically be considered clean simply because they appear to be trading proceeds.

Using a DEX is not inherently a criminal act. The issue lies in the source of the funds and the purpose of the users' transactions.

Read also: What Is a PHP Vulnerability? Risks and How to Address Them

North Korean Hackers Allegedly Involved in the Binance Hack

The Binance hack also attracted the attention of U.S. authorities.

On October 31, 2026, the Federal Bureau of Investigation (FBI) linked the theft to activities by a North Korean cyber group known as TraderTraitor.

The group had previously been linked to several attacks targeting the cryptocurrency industry. Its activities have involved not only stealing assets but also moving funds after attacks take place.

In the Binance case, investigators found that various blockchains and crypto services were used to transfer stolen assets.

A Similar Method Was Seen in the Bybit Case

The use of tokens as intermediaries for money laundering is not an entirely new finding.

During the investigation into the 2025 Bybit hack, a group linked to North Korea was also found to have used new tokens on the TRON network to obscure funds. At least US$24 million was reportedly moved through this mechanism.

A similar pattern was identified again after the Binance hack, this time involving tokens on the TRON and NEAR networks. Related activity also appeared on Solana, although it involved existing tokens rather than new ones created by the perpetrators.

These findings show how perpetrators can exploit different blockchain infrastructures to complicate transaction investigations.

However, the use of a network for illegal activity does not mean its blockchain operators were involved or that the network itself was hacked.

Read also: Bitget Allegedly Hacked: US$388 Million in Assets Affected, North Korea Under Scrutiny

Can the Stolen Funds from the Binance Hack Still Be Traced?

Although the transactions passed through numerous wallets and different assets, investigators can still follow the trail of funds stolen in the Binance hack. This is possible because public blockchains retain transaction records that can be examined later.

Using meme coins lengthens the trail investigators must analyze, but it does not erase the history of asset movements. In the case of the six NEAR tokens, three findings revealed strong connections between the trading activity and the network handling the stolen funds.

1. Almost All Transactions Came from Connected Wallets

All sales of the six tokens were carried out by wallets within the network under investigation. For five of the tokens, all purchases also originated within that network.

Only FUK attracted some purchases from outside parties, accounting for less than 1% of its total trading volume. This indicates that nearly all buying and selling took place within a circle of interconnected wallets.

2. The Token Creations Were Linked

Five of the six token issuers received funds from wallets that had previously sold other tokens. The time gaps were remarkably short, ranging from two to thirteen minutes before the next token was launched.

These connections suggest that the token issuances were not a series of unrelated activities.

3. The Values of Incoming and Outgoing Funds Were Nearly Identical

Approximately 117,000 NEAR was identified as entering through activity involving the six tokens. Nearly the same amount subsequently left the recipient wallets before some of it was converted into other assets.

This pattern strengthens suspicions that the main purpose of the trades was not to profit from token price movements. Instead, the activity was allegedly used to alter how the history of fund transfers appeared.

These three findings show that blockchain transactions can still be traced even when their paths become increasingly complex.

Read also: Revolut US$3 Million Hack: The Digital Attack Method Threatening Global Fintech Security

How Does This Case Affect Crypto Security?

The Binance hack highlights a new challenge for cryptocurrency transaction monitoring.

Threats arise not only from attacks on exchanges but also from the methods perpetrators use to move assets after a theft.

For blockchain analytics companies and crypto service providers, monitoring wallet addresses flagged as suspicious may not be enough.

The history of assets passing through liquidity pools, connections between wallets, and activity involving newly created tokens must also be examined to help identify risky transactions.

For investors, meanwhile, the case is a reminder that high trading volume does not always indicate genuine market interest.

What Crypto Users Should Watch Out For

There are several steps users can take to reduce risks when interacting with digital assets:

• Verify the token's identity. Make sure its name, network, and contract address match reliable project information.
• Examine trading activity. A newly launched token with high volume but only a small number of participating wallets warrants closer scrutiny.
• Do not blindly follow trends. Price surges and high volume do not necessarily reflect healthy market demand.
• Protect your wallet. Avoid connecting your wallet to applications or websites whose credibility is unclear.

These precautions cannot eliminate every risk, but they can help users make more informed decisions.

If you want to follow developments in digital asset security and the latest crypto news, you can also sign up for Bittime to explore market information and the assets available on its platform.

What Is the Latest Status of the Stolen Binance Funds?

Efforts to trace the funds stolen in the Binance hack are ongoing. According to an investigation report dated November 9, 2026, approximately 11.8 million NEAR originating from the theft had not yet moved from the wallets holding those assets. At the time, their estimated value was US$43.7 million.

In addition to the NEAR assets, investigators were monitoring movements of other cryptocurrencies across various blockchain networks. Some funds associated with the hack had been frozen, while other assets remained under investigation.

It remains uncertain how much of the stolen money will ultimately be recovered.

The discovery that meme coins were used also demonstrates that investigators cannot focus solely on large asset transfers. Small transactions that appear ordinary may also be connected to a broader money-laundering network.

Conclusion

The Binance hack case revealed how six meme coins on the NEAR network were allegedly used to disguise approximately US$430,000 in stolen funds. By trading through DEX liquidity pools, the perpetrators sought to make asset movements look like ordinary market transactions.

Even so, this approach did not truly erase the trail of funds on the blockchain. By examining trading patterns, wallet connections, and transaction histories, investigators identified links between the assets.

For crypto users, the case underscores the importance of understanding the risks of new tokens, protecting digital assets, and not treating heavy trading activity as proof that a project is trustworthy.

Bittime is a licensed Digital Financial Asset Trader (PAKD) regulated and supervised by Indonesia's Financial Services Authority (OJK) — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from IDR 10,000. Registration is fast and secure, and you can get started today.

Track USDT to IDR conversion rates and the real-time price movements of your favorite crypto assets. Everything is available in one crypto investment app that you can download for free from the Play Store.

Ready to get started? Sign up for Bittime now and put your investment strategy into action on a platform trusted by millions of users in Indonesia.

FAQ

What happened in the 2026 Binance hack?

Binance suffered a hack on October 29, 2026, with the value of stolen assets estimated at US$6.4 billion. The FBI linked the attack to a North Korean cyber group known as TraderTraitor. Subsequent investigations uncovered the use of meme coins to conceal some of the stolen funds.

How did the Binance hackers use meme coins to launder money?

The hackers allegedly used newly created tokens and DEX liquidity-pool activity to obscure connections between wallets associated with the stolen funds. The transactions appeared to be ordinary crypto trading, but blockchain analysis revealed patterns indicating links to a money-laundering network.

Why are DEX liquidity pools used in crypto money laundering?

Liquidity pools enable assets to be exchanged through smart contracts without requiring direct transfers between buyers and sellers. This mechanism can be misused to complicate tracing the origins of funds, although all transactions remain publicly recorded.

Was NEAR Protocol also hacked in the Binance incident?

No findings indicate that NEAR Protocol itself was hacked. The network was used to host token activity and transactions allegedly linked to laundering proceeds from the Binance hack.

Can stolen cryptocurrency still be traced?

Yes. Transactions on public blockchains can generally still be traced through on-chain analysis. However, moving funds across multiple wallets, tokens, and exchange services can make investigations longer and more complex.