The hackers who stole US$6.3bil (RM25.55bil) from Binance Holdings Ltd in crypto’s biggest ever heist have turned to one of the sector’s most gimmicky assets to launder a slice of the proceeds: memecoins.
At least six new tokens were created on the Near blockchain network within days of the theft, blockchain analytics firm Elliptic said, which allowed the attackers to pass through about US$430,000 (RM1.74mil) of the stolen crypto. The scheme was designed to disguise the path of money – rather than dupe unwitting traders into exchanging stolen assets for clean cash – and make it harder to trace where the ill-gotten gains eventually ended up.
Each of the six tokens – identified as FUK, OLCCL, MEILI, MMLI, DABI and SINU – traded heavily for a few hours after creation before being abandoned, Elliptic said. The hackers used Near tokens stolen from Binance to buy up the memecoins on decentralised exchanges, allowing them to receive the stolen Near in unconnected wallets on the other side of the trade. About US$44mil (RM178mil) in stolen Near remains untouched.
The tokens bore logos in classic memecoin style. One showed a picture of a monkey wearing a pink bow, while another featured an image of Elon Musk under a banner that read "Elon 2028 President”, Elliptic said. There is no suggestion that the Tesla Inc chief executive officer has any connection to the token, it added.
"Meme coins are launched and traded in the thousands, and most fade within days, so one more short-lived token with a cartoon logo attracts little attention,” Tom Robinson, Elliptic’s founder and chief scientist, said in a blog post on Nov 9. "A wallet whose history shows trades in a new meme coin looks like a speculator rather than a launderer, unless someone checks where its money came from.”
It’s a tactic that was first spotted last year in the aftermath of another heist, where suspected North Korean hackers laundered at least US$24mil (RM97.2mil) stolen from crypto exchange Bybit through memecoins. The Oct 29 attack on Binance has also been attributed to North Korea by US authorities, who pointed to the TraderTraitor group as being responsible.
The maze of tools in which Binance’s hackers are laundering their funds has drawn a great deal of attention in the wake of the theft. Stolen assets have been transferred through thousands of digital wallets and across multiple blockchains in an effort to obscure their origins, with blockchain security firm Chainalysis recently highlighting the role of Chinese money-laundering networks in cashing out the funds.
The automated nature of the transactions was also notable in this case. Within a week of the hack, the laundering effort has used more than 20,000 wallets and executed at least 65,000 transactions, Elliptic said in a Nov 7 post – equating to roughly one new wallet being used every 30 seconds and one transaction completed every 10 seconds.
Around US$3.13bil (RM12.6bil) remains with the hackers in wallets linked to the theft, it added, mostly denominated in Bitcoin and Ether. The hackers likely opted to swap as much of their stolen proceeds as possible into those tokens because they cannot be frozen by their issuers, allowing a much longer time frame for laundering. The attackers have used decentralised, privacy-focused networks like THORChain, Privacy Cash and Wasabi Wallet to execute the trades.
A further US$2.85bil (RM11.55bil) of the stolen crypto was either frozen or intercepted, Binance Co-chief executive officer Richard Teng said on a livestream on Nov 9. Much of this was in stablecoins – cryptocurrencies that aim to maintain a one-to-one value with another asset like the US dollar – where issuers like Tether and Circle Internet Group Inc can step in to stop the tokens from being swapped for real cash. – Bloomberg
