OMITTED

What the news leaves out.

← Omitted front page

North Korean Hackers Steal Billions from Binance in Fake Interview Scheme

26 sources · updated 2026-11-04
Left 46% Center 23% Right 31%
12 left · 6 center · 8 right

What happened

On October 29, cryptocurrency exchange Binance discovered unauthorized withdrawals totaling about $6.3 billion from its wallets. The FBI attributed the theft to a North Korean operation it calls TraderTraitor; Kim Yo Jong, sister of North Korean leader Kim Jong Un, denied any involvement and called the accusation a "grave political provocation." Binance said attackers spent months getting in: in June an engineer downloaded a tampered installer advertised as an AI coding tool, and in September another engineer was lured through fake job interviews to install malware, after which the attackers used an internal AI tool to help authorize wallet transactions. The exchange halted then restored withdrawals in phases starting November 1, recorded several billion dollars in net customer outflows, pledged to cover all user losses from company funds, and said it had replenished most stolen assets; stablecoin issuers including Circle froze more than $1.1 billion in USDC, and analytics firm Elliptic said about $2.85 billion of the stolen funds had been frozen or seized.
Sourcing check · Mostly on the record · 26 articles

23 of 26 articles cite a named source for the story. It was on the record from the first report. Kim Yo-jong denied part of it on the record.

What these terms mean and how they're counted
On the record · names a source 23 of 26
On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: Binance, FBI, TRM Labs, Circle, Changpeng Zhao and Elliptic
Primary evidence · cites a document or data 5 of 26
Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: security report, company statement, official statement, company investigation
Credits another outlet 0 of 26
The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
Unnamed sources 4 of 26
The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
On-record denial 3
A named person or institution says the claim, or part of it, is not true. It is on the record — someone signed their name to it — but it is not confirmation, so it never counts toward On the record. Criticizing or dissenting from a decision is not a denial. The count is how many people or institutions deny it; each is listed with the first article that carried the denial. Here: Kim Yo-jong (Business Insider, Nov 3, 05:49 UTC); Kim Yo Jong (CNBC, Nov 3, 06:32 UTC); North Korea (Breitbart, Nov 4, 18:49 UTC)
How it developed
When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Oct 31, 18:40 UTC by The Verge, naming its source. First document 16 hours later, from CBS News (company statement).
Not counted 0
Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
Omitted — what each side leaves out

Unpacked

Right-leaning coverage treats the unfrozen stolen crypto as already gone. Left-leaning coverage reports those coins still sit in wallets tied to the theft. The New York Post told readers the remainder "was lost forever." CNBC, citing Elliptic, said only a negligible amount of stolen funds appeared to have been cashed out. A reader of one side walks away thinking the rest of the stolen crypto has vanished. A reader of the other walks away thinking investigators can still see where most of the coins sit. Right-leaning coverage leads with customers being made whole. Left-leaning coverage leads with money leaving the exchange. Fox Business opened on Teng's pledge that users will not bear the loss. CNBC opened on customers who "rushed to move funds off the platform." How much of the crypto still sitting in those known wallets can still be frozen or recovered?
Bottom line

The New York Post treated the leftover Binance coins as already gone; CNBC's tracing report still has those coins sitting in known wallets, almost none of them cashed out.

The receipts — 3 facts one side's coverage lacks
  • Only a negligible amount of stolen funds had been cashed out, with roughly $3.24 billion still in addresses linked to the theft numberin CNBC · absent from right-leaning coverage
  • Kim Yo Jong suggested who received the stolen crypto could reveal the culprit, citing Trump administration plans to seize illicit crypto as a strategic reserve official statementin Business Insider · absent from right-leaning coverage
  • In the first four days, hackers used roughly 12,000 wallets across 11 blockchains numberin CNBC · absent from right-leaning coverage
The Left View
Left-leaning outlets treated resumed withdrawals as a test of trust, tracked how stolen coins were moved, and gave prominent space to Pyongyang’s rebuttal. CNBC reported $3.64 billion in net outflows after Sunday’s reopening—2.1% of Binance’s $171 billion in assets—and quoted Changpeng Zhao saying "98% choose to stay!" and that "Trust isn't earned by what you say in good times. It's earned by what you do in hard times." Coverage amplified Kim Yo Jong’s charge that Washington was trying to "brand the DPRK as a 'cyber criminal state'" and her suggestion that U.S. plans to confiscate illicit cryptocurrency as a strategic reserve could offer "a clue about who is behind the hacking incident." The Verge argued that "what's less clear is why this particular attack worked," citing years of warnings about interview malware and "little detail on the 'internal AI tool.'" Elliptic and Chainalysis described automated laundering across roughly 12,000 wallets and 11 blockchains, with most remaining stolen funds still in bitcoin and ether rather than cashed out.
The Right View
Right-leaning outlets framed the theft as "the largest bank heist in history" by a North Korean unit that U.S. officials say helps fund roughly half of Pyongyang’s missile program. They stressed that users would not bear losses: Fox Business quoted co-CEO Richard Teng saying "No, not at all" when asked if customers lost money, that "the full financial impact will be borne by us," and that 98% of impacted assets had been replenished. The New York Post reported more than $4.7 billion in outflows as only about 3% of assets, said withdrawal levels were "stabilizing to normal," and noted Bitcoin was "little changed" while Binance still listed $157 billion in assets after tapping SAFU and treasury funds. Teng argued "financial strength matters" because "many platforms would not have survived an episode such as this," and coverage tied the breach to a broader surge in AI-enabled crypto hacks.
Our Take (balanced)
The left’s strongest argument is that the breach succeeded through well-known social-engineering tactics researchers have warned about for years, and that Binance has not adequately explained how undetected malware and an internal AI tool let attackers authorize billions in transfers—The Verge’s question of "why this particular attack worked" is the core of that critique, reinforced by Binance’s own claim that it had already blocked 57 suspected North Korea-linked cases this year. The right’s strongest argument is that no customer lost funds, outflows were a small share of a still-large balance sheet, and markets quickly stabilized, which Teng’s "users are not compromised" claim and the replenishment figures are meant to demonstrate. The central unresolved tension is whether the episode is mainly evidence of a preventable security failure at a systemically important exchange, or of a well-capitalized platform absorbing an unprecedented nation-state theft without imposing losses on users.

26 sources

More stories

The week's bottom lines, in your inbox

One email a week: the five stories that mattered and what they actually mean. Free.