[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa2NGI2rUODaCIZMvC4084Q7UmJCn-6iYdSi0OkBOERw":3},{"article":4,"iocs":56,"watch_terms":59,"solutions":60,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a39832e5-eb31-434b-922b-03ce5759bd70","North Korean Hackers Create Fake Meme Coins to Launder Stolen Funds From $6.4 Billion Binance Hack","north-korean-hackers-create-fake-meme-coins-to-launder-stolen-funds-from-6-4-bil-82eaf0","North Korean hackers are creating disposable meme coins to move cryptocurrency stolen in the $6.4 billion Binance hack, using fake trading activity to make criminal proceeds resemble ordinary investment returns. The operation places decentralized exchange liquidity pools between wallets holding stolen assets and wallets collecting the proceeds, complicating efforts to trace and freeze the money. […] The post North Korean Hackers Create Fake Meme Coins to Launder Stolen Funds From $6.4 Billion Binance Hack appeared first on Cyber Security News.","North Korean hackers, attributed to the TraderTraitor group, are employing newly created meme coins on decentralized exchanges to launder cryptocurrency stolen from the $6.4 billion Binance hack. This method involves creating liquidity pools with fake trading activity to obscure the origin of the funds, making them appear as legitimate investment returns. Researchers have identified six such tokens launched on the NEAR blockchain, with similar techniques observed on Tron and Solana.","North Korean hackers use fake meme coins to launder funds from Binance hack.","https:\u002F\u002Fcybersecuritynews.com\u002Ffake-meme-coins\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FNorth-Korean-Hackers-Create-Fake-Meme-Coins-to-Launder-Stolen-Funds-From-6.4-Billion-Binance-Hack.webp","2026-11-10T08:25:01+00:00","2026-11-10T09:00:30.523674+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"TraderTraitor","threat_actor",{"name":21,"type":22},"Binance","vendor",{"name":24,"type":25},"NEAR","product",{"name":27,"type":25},"Tron",{"name":29,"type":25},"Solana","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":34,"value":18,"context":58},"North Korean hacking group attributed to the Binance hack.",[21,24,27],{"controls":61,"vendors":119},[62,90],{"slug":55,"name":63,"problem":64,"products":65},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":91,"name":92,"problem":93,"products":94},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":132},"north-korean-hackers-use-fake-meme-coins-to-launder-64b-binance-hack-proceeds","North Korean Hackers Use Fake Meme Coins to Launder $6.4B Binance Hack Proceeds","The TraderTraitor group, linked to North Korea, is exploiting the pseudonymous and permissionless nature of decentralized exchanges (DEXs) to launder billions in stolen cryptocurrency by creating fake meme coins and artificial liquidity pools. Because DEX transactions lack robust Know Your Customer (KYC) or Anti-Money Laundering (AML) controls, illicit funds can be layered through synthetic trading activity and made to appear as legitimate investment returns. This case highlights the critical gap between the speed of blockchain-based financial innovation and the maturity of on-chain monitoring and regulatory oversight. The scale of the laundering operation — spanning NEAR, Tron, and Solana blockchains — demonstrates that threat actors are actively exploiting multi-chain environments to evade detection. Without proactive on-chain analytics and coordinated incident response, stolen funds can be effectively obscured within hours of a breach.",[125,126,127,128,129,130,131],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","DORA Article 9","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"DORA Article 9":133,"NIS2 Article 21(2)(b)":134,"MITRE ATT&CK T1566: Phishing":135,"NIST SP 800-53 SI-2: Flaw Remediation":136,"CIS Control 17: Incident Response Management":137,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":138,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":139},"DORA mandates robust ICT security controls and incident reporting for financial entities; compliance would require exchanges to implement the monitoring, threat detection, and rapid notification capabilities needed to catch laundering activity early.","NIS2 requires incident handling procedures for critical digital infrastructure; applying this to cryptocurrency exchanges would mandate the detection, response, and cross-border reporting capabilities necessary to disrupt large-scale laundering operations like this one.","TraderTraitor is known to gain initial access via spear-phishing campaigns targeting crypto industry employees, making phishing defense a foundational control to prevent the compromise that enables subsequent fund theft and laundering.","The underlying hack exploited weaknesses in Binance's platform; timely identification and remediation of security flaws would have prevented the initial theft that made the laundering operation possible.","A mature, cryptocurrency-aware incident response plan with pre-established contacts across blockchain networks and law enforcement is essential for rapidly tracing and freezing laundered funds before they are fully obscured.","Systematic vulnerability management across the exchange platform would address the technical weaknesses exploited in the initial breach, removing the attacker's foothold before billions could be stolen and subsequently laundered.","Stronger identity and access controls at the point of the original Binance breach — and within DeFi platform interactions — could have limited the attacker's ability to exfiltrate and move billions in assets undetected."]