North Korea Denies Role in Massive Binance Crypto Heist
Left 100%
Center 0%
Right 0%
3 left · 0 center · 0 right
What happened
On or about October 29, 2026, cryptocurrency exchange Binance discovered unauthorized withdrawals of about $6.3 billion in virtual assets, temporarily suspended withdrawals, and said it had frozen about $3 billion while investigating. The company later said a compromised laptop used by a DevOps engineer was among the points of intrusion and that it found no evidence wallet private keys had been leaked. On October 31, the FBI attributed the theft to North Korean actors it calls TraderTraitor and said stolen assets were being converted primarily into Ethereum. Binance began restoring withdrawals in phases on November 1 and reported a net outflow of about $3.64 billion in under 10 hours. North Korea, through Kim Yo-jong in a statement carried by state media, denied involvement and called the FBI allegation a grave political provocation.
Sourcing check · Fully on the record · 3 articles
3 of 3 articles cite a named source for the story. It was on the record from the first report. Kim Yo-jong denied part of it on the record.
What these terms mean and how they're counted
- On the record · names a source 3 of 3
- On the record means the article cites a source by name for the story's main claim: a person, or an institution speaking officially, such as a company statement or a named agency's spokesperson. The opposite is an unnamed source. The count is how many of the counted articles cite at least one such source; the names are everyone named across them, each once however the articles spell it. Here: FBI, Binance, Elliptic and Chainalysis
- Primary evidence · cites a document or data 0 of 3
- Primary evidence means the article cites a record you could check yourself: a court filing or ruling, a dataset or report, a recording or transcript, an official statement or press release, market data. A quote is not a document. The count is how many articles cite one. Here: None cited.
- Credits another outlet 0 of 3
- The article says the story comes from another outlet's reporting (“first reported by Reuters”). Those articles relay the story; they are not independent confirmation. Here: Each article presents its own reporting.
- Unnamed sources 0 of 3
- The main claim is attributed to people who are not identified: “people familiar with the matter”, “officials said”. The count is how many articles do this.
- On-record denial 2
- A named person or institution says the claim, or part of it, is not true. It is on the record — someone signed their name to it — but it is not confirmation, so it never counts toward On the record. Criticizing or dissenting from a decision is not a denial. The count is how many people or institutions deny it; each is listed with the first article that carried the denial. Here: Kim Yo-jong (Business Insider, Nov 3, 05:49 UTC); Kim Yo Jong (CNBC, Nov 3, 06:32 UTC)
- How it developed
- When the first report landed and whether it named anyone; when the first named source and the first document appeared. Here: First report Nov 1, 14:33 UTC by The Verge, naming its source.
- Not counted 0
- Opinion, analysis and video pieces, and articles too short to assess. Every count above is out of the counted articles. An article republished under a new headline is one article.
This is about who is cited, not whether the story is true. Each source below says what it names. How we count
ONE-SIDED THIS WEEK.
Only left-leaning outlets have covered this story in the last two days;
New York Post reported it on 2026-11-02.
Omitted — what each side leaves out
Unpacked
Right-leaning outlets had not covered this as of publication; left-leaning coverage has. Left-leaning outlets report an FBI finding that North Korea stole billions from Binance and a denial from Kim Yo Jong. They disagree on the denial itself. The Verge never reports it and says the bureau offered few other details, while CNBC adds that blockchain firms also tied the flow of stolen coins to North Korea-linked actors. A reader of the silent side would not know the heist was attributed, disputed, or traced.
Left-leaning coverage also splits on what to put first. Kim Yo Jong's denial leads at Business Insider, which quotes her calling the charge a "grave political provocation" and notes her hint that a U.S. plan to seize illicit crypto could reveal the culprit. The money trail leads elsewhere, with CNBC following stolen coins across 12,000 wallets and noting that issuers froze a large share of the take.
What evidence, beyond the TraderTraitor label and wallet clustering, shows the North Korean state ran the theft?
Bottom line
The right has not covered the $6.3 billion Binance theft at all, and The Verge told the FBI's North Korea story without Kim Yo Jong's denial.
The receipts — 2 facts one side's coverage lacks
- About $2.85 billion of the stolen funds has been frozen or seized.
- Binance said it has covered about 95 percent of the affected amount.
The Left View
The Verge, Business Insider, and CNBC reported the FBI’s attribution of the Binance theft to North Korea-linked actors under the name TraderTraitor, Binance’s freeze and phased reopening of withdrawals, and Pyongyang’s denial. They quoted Kim Yo-jong, via KCNA and Yonhap, saying the FBI was branding North Korea a cyber criminal state and misleading world opinion by treating cybercrime as North Korean work, and they noted her remark about U.S. plans to confiscate illicit crypto. CNBC and related coverage also cited Elliptic and Chainalysis: roughly 12,000 wallets across 11 blockchains, more than 40,000 transactions, heavy use of Tron then bridges to Ethereum, conversion of stablecoins before freezes, and estimates that about $2.85 billion had been frozen or seized while about $3.24 billion remained in linked addresses. Binance said it had covered about 95% of the affected amount.
Our Take (balanced)
The theft itself is substantive: Binance confirmed a large unauthorized withdrawal, named amounts, a freeze, intrusion details, and a restoration timeline. Attribution to North Korea remains alleged. It rests on an FBI statement that offered few public details or evidence, plus blockchain-tracing reports from Elliptic and Chainalysis that link fund movement to previously labeled North Korea-linked activity; North Korea has denied the charge. No right-leaning outlet has reported this. Watch for a fuller FBI or Treasury record, independent replication of the wallet tracing, Binance’s complete incident report, and any further official U.S. or North Korean response.
3 sources
More stories
The week's bottom lines, in your inbox
One email a week: the five stories that mattered and what they actually mean. Free.