Binance's hackers are laundering stolen crypto through memecoins with names like FUK and SINU: $3.1 billion is still out there as bitcoin hits a two month low

Where is the money stolen from Binance now? About 3.13 billion dollars of it is still sitting in wallets controlled by the hackers, mostly in bitcoin and ether, and some of it has been pushed through a surprising tool: memecoins. At least six new tokens were created on the NEAR blockchain within days of the 29 October theft, blockchain analytics firm Elliptic said, letting the attackers move about 430,000 dollars of stolen crypto through apparently ordinary trades, Bloomberg reported via The Straits Times.

The laundering effort is unfolding as crypto markets wobble. Bitcoin and ether fell to their lowest levels in more than two months after the US midterm elections, as investors worried that a Democratic controlled Congress will toughen regulation, Reuters reported. Together, the heist and the political shift have made November a difficult month for the industry, and for Binance in particular.

How the memecoin trick works

The hackers used NEAR tokens stolen from Binance to buy newly created memecoins on decentralised exchanges, and received NEAR in unconnected wallets on the other side of those trades. The aim was not to fool traders into buying worthless tokens, but to break the visible chain between the stolen funds and the wallets that end up holding them.

Each of the six tokens traded heavily for a few hours after creation and was then abandoned, Elliptic said. They carried classic memecoin branding: one showed a monkey wearing a pink bow, another an image of Elon Musk under a banner reading "Elon 2028 President". Elliptic said there is no suggestion that Musk has any connection to the token.

"Memecoins are launched and traded in their thousands, and most fade within days, so one more short lived token with a cartoon logo attracts little attention," Elliptic founder Tom Robinson wrote. "A wallet whose history shows trades in a new memecoin looks like a speculator rather than a launderer, unless someone checks where its money came from."

The scale of the laundering machine

The memecoins are a small part of a much larger operation. Within a week of the hack, the laundering effort used more than 20,000 wallets and executed at least 65,000 transactions, Elliptic said, roughly one new wallet every 30 seconds and one transaction every 10 seconds. That pace points to heavily automated tools.

The attackers have swapped as much as possible into bitcoin and ether, which cannot be frozen by an issuer, giving them more time to launder. They have used decentralised and privacy focused services including THORChain, Privacy Cash and Wasabi Wallet. Chainalysis has highlighted the role of Chinese money laundering networks in cashing out the funds.

The memecoin tactic is not new. It was first spotted in 2025 after the Bybit hack, when suspected North Korean hackers laundered at least 24 million dollars through memecoins. US authorities have attributed the Binance attack to North Korea's TraderTraitor group, the same broad network blamed for several of the largest crypto thefts in recent years.

The hackers are not trying to hide from the blockchain. They are trying to look like everyone else on it, and in a market full of throwaway tokens, that is easier than it should be.

What Binance has recovered

Binance co chief executive Richard Teng said on a livestream on 9 November that 2.85 billion dollars of the stolen crypto had been frozen or intercepted. Much of that was in stablecoins, whose issuers, such as Tether and Circle, can block tokens from being swapped for cash. That is why the hackers moved quickly into assets that cannot be frozen.

Binance had already said it covered about 95 percent of customer losses and reopened withdrawals within days of the attack, as we reported in our original coverage of the 6.3 billion dollar Binance hack. The freezing and tracing efforts now determine how much of the remaining loss can be clawed back.

The numbers suggest a long chase. With about 3.13 billion dollars still in hacker linked wallets and much of it in bitcoin and ether, recovery will depend on catching funds at the points where they meet regulated exchanges and over the counter desks that must check customers.

Why crypto prices fell

Crypto markets were shaken by both the heist and politics. Bitcoin and ether touched their lowest levels in more than two months in late Sunday trade on 8 November, Reuters reported, as investors fretted that a Democratic controlled Congress will toughen regulation of the asset class after the election of high profile critics in the midterms, VnExpress reported.

Hotter than expected US inflation data this week has added pressure, by lifting bets on a Federal Reserve rate hike in December, which tends to weigh on speculative assets. We covered that shift in our report on October's US inflation and the December Fed outlook.

For Asian crypto users, the combination matters. Exchanges in the region, many of which compete with Binance, face tougher scrutiny of anti money laundering controls, and regulators in Singapore, Hong Kong and elsewhere have been tightening licensing rules.

What it means for exchanges and users

The Binance case offers lessons for everyone in the industry:

• automated laundering now runs at a speed that manual compliance cannot match
• memecoins and new tokens can be used as cover for moving stolen funds
• stablecoin issuers' ability to freeze funds is a powerful recovery tool
• exchanges and over the counter desks are the choke points where stolen funds can be stopped

For users, the practical advice is unchanged: keep only what you need on any single exchange, use strong security on accounts, and be wary of newly launched tokens with no clear purpose, which may be used for laundering or simple fraud.

For regulators, the heist strengthens the case for stricter rules on cross chain bridges, privacy tools and token launches. With US politics shifting and Asian regulators already tightening, the industry should expect more oversight, not less.

The Binance hackers are laundering at industrial speed, using memecoins as camouflage and moving most of the loot into assets that cannot be frozen. Binance has clawed back a large share, but more than 3 billion dollars remains at large as crypto prices slide and political pressure grows. The chase will now be won or lost at the exchanges and desks where stolen coins try to turn into cash.