North Korea used memecoins to launder the Binance hack. We traced it on Solana.

The heist, in short

On Thursday, October 29, 2026, starting at about 20:04 UTC, Binance's own hot wallets sent their contents to its attackers. On the XRP Ledger first, then Solana at 20:10, then Bitcoin, Tron, Ethereum and others (Bitquery, Elliptic).

Binance puts the loss at about $6.34 billion, Elliptic at $6.43 billion on 11 chains, the largest theft in crypto's history. Binance says it will absorb it, not its users, and that $2.85 billion was frozen or intercepted.

How they got in, in Binance's own report of November 3 (Binance blog):

Nothing could be frozen on Bitcoin, XRP, NEAR or Solana's SOL. This report follows the SOL.

Is it really North Korea?

Officially, yes, for the United States. On October 31 the FBI, with the Secret Service and IRS-CI, wrote that North Korea “was responsible for the theft of more than $6 billion” from Binance, and named the activity TraderTraitor (FBI). It listed the addresses for exchanges to block: 608 on Ethereum, 19 on Bitcoin and one on Solana, AffzFD…EaU, the wallet this report follows. It is the group the FBI blamed for Bybit's $1.5 billion in February 2025.

Binance's own report rests on that: “The latest information released by the Federal Bureau of Investigation indicates that the Democratic People's Republic of Korea is responsible for this incident.” It adds that its security team stopped 57 suspected North Korea-linked attempts in 2026, using fake job interviews and tampered developer tools among others.

Chainalysis, TRM Labs and Elliptic had said the same before the FBI. Their reasons, as they published them:

• Chainalysis watched funds from this hack mix in real time with funds from the September 2026 Bitget theft, itself attributed to North Korea.
• TRM pointed to the same playbook as Bybit: a wallet funded through Tornado Cash, rehearsals hours before, signed approvals used in one burst.
• Elliptic cited the Bitget mixing, laundering services shared with earlier TraderTraitor thefts, and Bybit-style methods. Fake job interviews, the way in here, are a known North Korean approach.

What is not public: the FBI's evidence. Binance's report names North Korea by citing the FBI, and nothing in its report says the fake recruiters presented themselves as Korean. North Korea denied it: Kim Yo Jong called the FBI's statement “a trite provocation”.

The chain can show where money went. It can't show whose hands are on the keys. What follows is what the chain shows. The name North Korea is the FBI's.

970,522 SOL in 23 minutes

Binance's Solana hot wallet, 5tzFki…uAi9 (Solscan: “Binance 2”), signed five transfers to a wallet that had never been used, AffzFD…EaU:

The first transfer, 965,455.1 SOL, is the one Bitquery timed at 20:10. Then four of exactly 1,266.7 SOL, one second, 16, 18 and 23 minutes later. The same amount four times looks like a script emptying whatever arrived. TRM Labs counted 970,500 SOL, about $96 million; the chain says 970,521.9.

61.5 hours, then a fake exit

Then nothing. The wallet didn't sign a single transaction for 61.5 hours, while the FBI named North Korea and Tether and Circle froze stablecoins.

At 09:38:28 UTC on November 1 it moved: a 7 SOL test, then 485,270 SOL forty seconds later, to a second new wallet, Eze86N…rrD.

That move made the news. Lookonchain posted that the hacker was “swapping $SOL for $BTC through @RelayProtocol”, and crypto.news reported 486,970 SOL moving within the hour.

The chain shows something else. The second wallet signed its own transfers back: 43 SOL and 240,000 SOL on November 3 at 17:46 and 17:48 UTC, and 245,234.01 SOL on November 4 at 05:45, 485,277.0 SOL in all (transfer, transfer). Half the stolen SOL went on a three-day round trip between two wallets run together.

Relay did get some. Wallets of the network sent 13,526 SOL to the Relay solver Solscan names “Relay 3”, all but 90 SOL of it on November 1, and got 1,800 back: 11,726 SOL net.

The real exit started 30 minutes after the round trip began. From 10:09 UTC on November 1 to 15:42 on November 4, the first wallet sent 972,066 SOL in 294 transfers to 123 wallets, from a few SOL to 18,942 SOL at a time.

Where every SOL went

We followed every transfer out of those wallets, SOL and plain token transfers alike, until the money reached something that wasn't a plain wallet: a pool, a lending vault, a bridge, a mixer, an exchange. That made 3,228 wallets. Eighteen chains of wallets, each passing one lump to the next, ran on to 51 to 101 hops from the first wallet; we followed those to their ends too.

Then we read every one of the 14,177 transactions those wallets signed and counted what each sent outside them. The total: 986,409.8 SOL. They hold 43.83 SOL today.

That is 15,888 SOL more than Binance lost: besides Binance's SOL, 15,932 SOL came into these wallets from outside and went out with the rest. Some of it was the hackers' own money coming back the long way. Wallet CptTum…V4b5 was handed 6,882.5 jlSOL, Jupiter Lend's receipt, redeemed it for 7,223.3 SOL and sent 6,223.3 SOL back in.

Nearly two thirds of it was simply sold. 333,860 SOL went to market makers through Jupiter's order engine, which hands a swap to the professional trader quoting the best price.

The two biggest takers were an unlabelled maker, FkaLnX…3MZp, with 189,046 SOL, and the account Solscan labels “Wintermute Automated Liquidity Bot”, with 133,077. On such an engine the aggregator picks the maker by price; the maker does not pick the trader.

Another 240,233 SOL went into Raydium's SOL-USDC pool, and 42,635 into other SOL-USDC pools through aggregators: Tessera V, SolFi, Kipseli, GoonFi, BisonFi and ZeroFi.

The memecoin trick, Solana version

On November 9 Elliptic published how the launderers were using memecoins on NEAR (Elliptic). Between November 5 and 7 they made six tokens, about $90 each, and moved some 117,000 NEAR, about $430,000, through them. Elliptic said a variant ran on Solana on November 3, through existing thinly traded tokens.

The trick: make a worthless token and a trading pool for it. Wallets holding stolen money buy the token. Other wallets, which got the token for free, sell it back and walk away with the money. No transfer ever links the two sides; the proceeds look like trading profit.

We found it on Solana, with tokens made during the laundering. Six bare tokens, created between November 3 at 00:38 and November 5 at 08:55 UTC:

• No name, no symbol: created with Solana's plain token program alone, no launchpad, no metadata, and Jupiter's token list has no name for any of them. The creators kept the right to mint more.
• Each paired with SOL in one small Raydium pool, four of them opened by the token's own creator and two by wallets tied to the creators (below).
• Bought 2,276 times by wallets of the hackers' network, a few SOL at a time, for 6,683.3 SOL. Five of the tokens never left those wallets. Of the sixth, AUoSrS, they passed 110 billion tokens to one outside wallet and sold 1.1 billion back, out of 631 billion bought.

Who took the SOL out

We read the two mid-size pools trade by trade. In the 4uXjPN… pool, the hackers' wallets put in 699.9 SOL and took out none. 837.9 SOL left to other wallets, 791.2 of it to 7 wallets that took 50 SOL or more each.

Look at one, Dcjtu…mRP9. At 03:10 UTC on November 4 the token's creator sent it 1 billion tokens. Three minutes later it started selling them into the pool, mostly 2.958 SOL at a time, 53 sales by 06:51. Then it sent the SOL on to two other wallets, about 97 SOL each.

The 9uJtAa… pool: 729.6 SOL in from the network, none back, 754.6 out to others, 733.9 to 7 wallets. Its two biggest collectors got 1 billion and 600 million tokens from the creator, minutes before they began selling.

All six pools are empty now: 0.06 to 0.08 SOL left each, every liquidity share redeemed.

The creators know each other

The wallets that made the tokens pass SOL among themselves. On November 5 the creator of AUoSrS got 38.67 SOL from the creator of Gimw9Y, sent 37.98 back half an hour later, then got 10 SOL more from it. It paid 9.66 SOL to the wallet that opened the 3AkeHG pool. The AUoSrS pool was opened by a wallet that also sent its creator 0.1 SOL.

On NEAR, Elliptic found the same kind of chain: five of the six creators funded, minutes before launch, by the wallet that had been selling the previous token.

Six tokens nobody named, made while the laundering ran, empty within days.

Not the first time

After Bybit in 2025, Elliptic found a worthless Tron token paired with a stablecoin that hid at least $24 million (Elliptic). On February 23, 2025, ZachXBT spotted a Bybit-linked wallet funding a pump.fun token called “QinShihuang”, which pump.fun then blocked (ForkLog).

This time, none of the 3,228 wallets touched pump.fun, PumpSwap, Meteora or any launchpad. The tokens were bare, which also kept them out of feeds that list new launches, Anceta's included: our feed never recorded them.

$54.9M to Ethereum, then Bitcoin

Most of the USDC left Solana through Circle's CCTP, the bridge that burns USDC on one chain and mints it on another. We decoded every burn the network made:

• 656 burns from 261 wallets, 18:31 UTC on November 3 to 16:17 on November 4.
• 54,908,335 USDC in all: 50,542,318 to 213 addresses on Ethereum, 4,366,017 to 23 on Avalanche.
• Most carried a fee of 0.05% to an unlabelled Solana account, inside the same transaction.

One wallet, Gu1TwG…kk6, shows the rhythm. From 09:12 on November 4 it received 10,000 SOL in two lots, sold it in five fills through the order engine, and burned 928,606 USDC to one Ethereum address: 8 burns in nine minutes.

On Ethereum we read the first 199 receiving addresses. Circle minted them 49,419,024 USDC in 567 mints, 99.7% of what was burned for them. The addresses claimed their mints themselves and sent most of the USDC on to a swap contract Blockscout names “GenericSwapExecutor”: 40,092,545 USDC.

Out came ETH, and the ETH went to THORChain, which swaps across chains with no account. Nine of the addresses sent 5,148.5 ETH to its router in 26 deposits, November 3 at 22:21 to November 4 at 16:23 UTC. Each deposit names the Bitcoin address to pay: 12 in all, and deposits of 3,949.0 ETH named one of them, bc1qpa…6ssq.

The other addresses forwarded their ETH to others first. We stop at the bridge's far end; Elliptic counts about 12,200 ETH, mostly from stolen SOL, swapped to bitcoin through THORChain by November 4.

Mixers, lending, an exchange

Privacy Cash: 78,595 SOL

Privacy Cash is a Solana mixer: deposit, and withdraw later to any wallet with a zero-knowledge proof. Wallets of the network made 127 deposits to its pool, mostly round sums of 200 to 1,000 SOL, on November 3 and 4: 78,595.2 SOL. Elliptic reported about 9,600 SOL on November 3 and 2,300 on November 4. The chain shows more.

Jupiter Lend: a receipt that changes hands

181,421 SOL was deposited in Jupiter Lend's SOL vault, which hands back a receipt token, jlSOL. The network got 172,863 jlSOL. It redeemed 77,521 itself and handed 95,343 jlSOL to 20 other wallets, which could redeem it for SOL with no transfer linking them to the network. That is the hop CptTum…V4b5 made above.

Marinade took 16,328 SOL for its mSOL receipt, and 11,651 mSOL went on to 12 other wallets, 10,987 to one.

HitBTC: 12,680 SOL

88 wallets that got their SOL from the network were emptied, on November 2 and 3, in 21 sweeps into the account Solscan labels “HitBTC Hot Wallet”, each paid for by the same account, 4bW8kk…uKZ. That is how an exchange collects its deposit addresses. We counted only the 12,679.5 SOL that came from the network; the same sweeps also carried other people's deposits. Whether HitBTC froze it, the chain does not say.

One busy wallet, and chains up to 101 hops long

6H7GCf…DBe is two years old and has no public label. It took 37,621 SOL from the network. Part came straight from wallets one hop from the exploiter. Another 16,646 SOL came down 18 chains of wallets, each passing one lump to the next, 51 to 101 hops from the exploiter.

Seventeen of the eighteen chains ended in this wallet; the eighteenth ran back into the network. We read four of those final payments: each carried a numeric memo, such as 420000022285951, the way exchanges and swap services tag a customer's deposit. From November 1 to 6 the wallet took in 37,958 SOL in lumps of 50 or more and sent the same amount out, almost all of it swapped through Jupiter. Who runs it, we can't say.

Smaller routes: HiFiSwap, 6,625 SOL; an unnamed program, mixpxD…RjmL, 9,067 SOL.

The week, hour by hour

The crowd around the wallet

A famous wallet draws a crowd. 649 other wallets put 1,597 transactions into the exploiter's history, without its consent:

• 1,072 PumpSwap trades by strangers that passed small sums through it, 32.1 SOL in all, so their coins showed up in the most-watched wallet of the week.
• 79 token airdrops from strangers, among them 650 million of a coin named “The Lazarus Group”. Another, “Lazarus Group official”, was sent to one of the wallets it paid.
• Look-alike addresses, such as GaBz66…VV8K next to the real recipient GaBzy3…VV8K, sent transactions into its history so that a careless copy-paste would pick them. Even thieves get address-poisoned. Their Ethereum addresses got fake “ETH” tokens the same way.

5,711 coins named after the hack

On Solana's launchpads the hack became a theme in about half an hour. From 20:04 UTC on October 29 to the same time on November 9, Anceta recorded 5,711 new coins whose name or symbol says Binance, SAFU, Lazarus, TraderTraitor, North Korea, DPRK, Kim Jong, Pyongyang or Changpeng. In the eleven days before, 290. The total number of launches barely moved: 493,492 against 450,163.

The first, “Stay SAFU”, launched at 20:35:44 UTC, before Binance had said a word. 121 such coins launched in the first hour.

2,622 of them came from one wallet, CXe9Cg…MQQo: every one named “BINANCE HACK”, symbol NORTHKOREA, from November 2 to 7. We found no tie between it and the hackers' network. It looks like a bot riding the news.

What was said, checked

What it means for new coins

A token can be a laundering pipe rather than a bet. These six showed it on the chain: no name and no symbol, a creator that kept the right to mint, one small pool, buying wallets that never sold, and, in the pools we read, sellers that got their tokens free from the creator. The network bought each one over a span of less than two hours to less than two days.

Elliptic lists the same signs for compliance teams. They are also things anyone can check before touching a new coin: who holds it, how they got it, and whether anyone outside one group of wallets ever traded it.

Pattern analysis, not financial advice. Similar coins can behave differently.

How we read it

Sources

1. 1.Binance, 29 October 2026 Binance Security Incident: Initial Findings and Response Update. November 3, 2026, Binance blog
2. 2.FBI, North Korea Responsible for $6 Billion+ Binance Attack. October 31, 2026, with the addresses
3. 3.Elliptic, North Korea is minting meme coins to launder the Binance hack. November 9, 2026
4. 4.Elliptic, How North Korea is laundering the $6.4 billion stolen from Binance. November 3, updated November 9
5. 5.Elliptic, the Binance hack
6. 6.Bitquery, Binance hack investigation. timeline by chain
7. 7.CoinDesk, FBI confirms North Korea's role. October 31, 2026
8. 8.CoinDesk, the hack began with a fake job interview. November 3, 2026
9. 9.Chainalysis, Binance exploit: latest findings
10. 10.Cointelegraph, live updates
11. 11.crypto.news, Binance hacker moves stolen SOL via Relay. November 1, 2026
12. 12.Elliptic, Bybit exploit six months on. the Tron token, 2025
13. 13.ForkLog, QinShihuang on pump.fun. February 2025
14. 14.Privacy Cash, program and documentation
15. 15.Binance Hot Wallet Exploiter 1, on Solscan
16. 16.Binance 2, Binance's Solana hot wallet, on Solscan
17. 17.A bridge recipient's THORChain deposits, on Blockscout

Related research

1. 1.How to check a new coin before you buy
2. 2.Mint and freeze authority on Solana, explained
3. 3.pump.fun's Callout Rewards, traced