Binance Hackers Use Elon Musk and Animal Memecoins to Launder Stolen Funds

How the Memecoin Laundering Operation Worked

The attackers used decentralized exchange liquidity pools to separate wallets holding stolen cryptocurrency from those collecting the proceeds. Rather than transferring NEAR directly between addresses, the operators bought newly created memecoins with stolen assets and sold those tokens through liquidity pools using other wallets.

Elliptic explained that this structure creates an additional transaction layer between the source of the stolen funds and their eventual destination.

"At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between," Elliptic wrote. "To a casual observer, the collecting wallets look like ordinary traders who have sold a token at a profit."

The proceeds generated by selling the memecoins were roughly equivalent to the amount initially used to purchase them. Elliptic found that much of the NEAR collected after the swaps subsequently moved into stablecoins or cross-chain bridges. All the newly created tokens involved in the identified transactions have since been abandoned.

The researchers also traced stolen assets to a token created on TRON and another on Solana. Separately, Elliptic identified activity on Solana involving existing tokens with limited liquidity, suggesting the attackers used more than one variation of the technique.

Elliptic stressed that the token creation tools and decentralized exchange infrastructure were used as ordinary participants could use them. The firm said these entities "did nothing wrong; the launderers simply used them as any other user could."

Although these transactions introduced additional steps into the movement of stolen assets, the transfers remained visible on public blockchains. Elliptic said the extra swaps could delay investigators and give the operators more time to move proceeds before their wallets were flagged.

Laundering Activity Extends Beyond Newly Created Tokens

The memecoin transactions represented only a portion of the stolen cryptocurrency traced to the attackers. Elliptic's findings and related tracking updates identified considerably larger asset balances and conversions.

Elliptic previously identified a similar laundering method following the $1.5 billion Bybit hack in 2025. That operation involved a homemade token paired with a stablecoin on TRON, allowing stolen cryptocurrency to move through trading activity rather than straightforward wallet transfers.

The Binance theft itself followed an attack that the exchange said had been planned for months. Its incident findings identified malicious developer software, a fraudulent job interview and compromised artificial intelligence tooling as parts of the operation. Binance said the FBI linked the attack to North Korea.

Binance Rejects Separate ShinyHunters Data Breach Allegations

Binance is also disputing allegations that a separate data breach exposed hundreds of millions of records belonging to its users. The exchange's customer-support account said on November 8 that its initial review pointed to a likely scam rather than a compromise of Binance's systems.

Cybersecurity monitoring firm ThreatMon identified a hacking-forum advertisement attributed to ShinyHunters claiming to offer 335,900,000 lines of information purportedly covering users across approximately 170 countries. The seller demanded $900,000 in Bitcoin or Monero and threatened to publish the advertised information unless Binance paid.

The listing allegedly contained email addresses, telephone numbers, passwords, identity documents, transaction histories, wallet private keys and internal infrastructure information. ThreatMon characterized the allegations as unverified and said the seller had placed a sample behind a forum paywall. The number of advertised records does not represent a confirmed count of affected individuals.

Binance said its preliminary examination found no evidence that the advertised information had originated from a compromise of its infrastructure or customer databases. The exchange also reported no indication that identity-verification documents, account credentials, private keys or internal infrastructure records had been exposed through the alleged breach.

The exchange challenged several details in the advertisement, including claims about plaintext passwords and private keys belonging to users' external wallets, which Binance said it does not store. The listing also referenced jurisdictions where Binance no longer operates.

Binance's support account noted that similar past advertisements had involved information gathered through infostealer malware on users' devices rather than breaches of the exchange's infrastructure.

Cybersecurity firm Brandefense reached a similarly skeptical assessment. On November 3, its research team examined four versions of related advertisements circulating on Telegram, without opening or testing an underlying data sample. The researchers considered the combination of personal identification documents, private keys and infrastructure information more consistent with recycled material or a scam than with a single data extraction. They could not establish that the advertisements contained genuine Binance information.

The alleged customer-data leak is distinct from the exchange's October 29 wallet attack. Binance's November 3 incident report put the value of that theft at approximately $6.34 billion and said attackers gained unauthorized access to an internal wallet-signing service, initiating transfers outside the exchange's normal withdrawal process. Its investigation connected the intrusion to compromised employee computers and stolen credentials.

Following the separate data-leak allegations, Binance urged customers to remain alert to phishing attempts and avoid sharing passwords, two-factor authentication codes, seed phrases or private keys.