Hackers linked to North Korea have developed an unusual method for moving cryptocurrency stolen from Binance. An investigation by blockchain analytics firm Elliptic uncovered a series of hidden tokens created specifically to move stolen funds through decentralized exchanges.
Among these tokens was a surprising creation featuring an image of Elon Musk alongside the slogan “Elon 2028 President.” The discovery offers another glimpse into how sophisticated cryptocurrency theft operations evolve to evade investigators.
Elon Musk’s Image Appears in North Korea’s Laundering Operation
The unusual Musk-themed token was among six disposable memecoins Elliptic traced on the NEAR blockchain between November 5 and November 7. Others carried names including FUK, OLCCL, MEILI, MMLI, DABI and SINU, with designs borrowing familiar internet culture and political imagery.
Creating these tokens required little money, with each launch costing approximately 25 NEAR, equivalent to around $90 at the time. The purpose was not to build communities, attract investors or establish lasting projects, but to provide temporary routes for moving stolen assets.
Musk’s appearance was therefore part of a token design, not evidence of any involvement by the billionaire in the operation.
Elliptic found that wallets connected to the laundering operation controlled virtually all purchases and sales involving the six tokens. Some coins had only one buying wallet and one selling wallet, suggesting carefully coordinated activity rather than genuine market demand. Once the transactions were completed, the tokens were abandoned, leaving little reason for anyone else to trade them.
How Disposable Tokens Help Move Stolen Crypto
The process begins when operators create a token and pair it with a valuable cryptocurrency inside a decentralized exchange liquidity pool. Wallets holding stolen funds then purchase the newly created token, effectively depositing valuable assets into the pool during those transactions.
Separate wallets subsequently sell the tokens, withdrawing digital assets from the same pool without receiving direct transfers from the original addresses. This separation makes the movement less obvious because the purchasing and collecting wallets never exchange funds directly.
Elliptic identified approximately 117,000 NEAR, worth around $430,000, moving through the six tokens during its investigation. The funds originated from addresses connected to the stolen crypto before passing through intermediate wallets and entering the trading pools. Much of the crypto collected afterward was converted into stablecoins or transferred across blockchain networks, extending the transaction trail.
The technique was not entirely new, as Elliptic had previously documented similar activity following the February 2025 Bybit exchange hack.
Chris Lion | November 9, 2026
Jonathan Agozie | November 9, 2026
