After the $6.3 billion Binance hack, the US State Department asks every UN member to enforce North Korea sanctions

What the spokesperson said, and what they left out

PANews, citing Yonhap, reported three points from the written response:

1. Coordination among governments is essential to counter North Korea's cyber activities.
2. All UN member states should implement the existing sanctions on North Korea, to stop it raising money for its weapons programmes.
3. Coordinated unilateral sanctions are a powerful tool for blocking financial flows that fund weapons proliferation.

Odaily carried the same statement at 03:57 SGT and added that the FBI had earlier blamed North Korean hackers for the Binance theft. The spokesperson did not disclose whether the investigation results had been shared with South Korea, or whether there had been bilateral talks on further sanctions.

The statement names no new sanction, no designated address and no seizure. Both reports trace back to the same Yonhap item, so they are one origin; we could not open the Yonhap original this run.

The numbers behind the statement

TechCrunch, reporting Binance's change of chief financial officer on November 7, put the theft at $6.3 billion and said that after withdrawals reopened, users took out a net $3.6 billion in the first few hours. Elliptic, the blockchain analytics firm, uses a total of $6.4 billion in its tracing report and gives the breakdown that matters for sanctions:

Elliptic writes that the attacker's first priority was swapping stablecoins, which issuers can freeze, into assets they cannot, such as ETH and TRX. On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived. Circle froze all of the USDC.

Our own arithmetic: $6.4 billion minus $2.85 billion leaves roughly $3.6 billion that is not frozen or seized. That is the money sanctions enforcement would have to reach, and most of it now sits in assets no issuer controls.

How the unfrozen part has been moving

Elliptic's timeline shows why the unfrozen share is hard to reach. In the first half hour after the theft, the 18,270 stolen BTC was split into 19 addresses, where it still sits. On Tron, almost nothing moved for about five hours after the first hour. Then, at 02:19 UTC on October 30 (10:19 SGT), a single distribution wallet began sending out the attacker's 684.6 million TRX. Elliptic calls Tron the main laundering route from that point.

Converted stablecoins are the part sanctions can still affect most directly. About $786 million was swapped before Tether and Circle froze the rest, and that money now moves as ETH and TRX. Every hop that ends at a service which screens addresses is a point where it can be stopped. That is the mechanism the State Department is asking governments to use.

Why a sanctions call matters to traders

Sanctions work through the businesses that touch the money: exchanges, OTC desks, bridges and the companies that run them. When a government asks every UN member to enforce existing rules, it is asking those businesses' regulators to refuse the stolen funds when they try to cash out. The 18,270 BTC that Elliptic says has not moved is the clearest test. If it moves into an exchange that screens addresses, it can be stopped there.

Nothing in the statement suggests ordinary user accounts are affected. Binance has not said the call changes its own process, and the reports carry no Binance comment.

What to check on your side

• If you have a pending Binance deposit or withdrawal, check its state in the app's history, not in messages from strangers.
• Treat any message promising "sanctions recovery", "hack compensation" or a refund form as a scam unless it appears in Binance's official app or verified channels. The State Department statement offers no compensation process.
• Watch for movement of the 18,270 BTC. Elliptic's report is the reference for the addresses' state as of its publication.
• Market context: at 04:57 SGT on November 8 the BTC perpetual traded at 75,612.7 USDT on Bitget and 75,609.5 USDT on OKX. Our liquidations page and funding rates board show whether positioning reacts.

Our earlier coverage of the attribution is in North Korea denies the Binance hack after the FBI names TraderTraitor, and the money trail is in stolen altcoins now sit as about 2,300 BTC.

What we could not confirm

We could not open the Yonhap report itself, so the wording above is PANews's and Odaily's rendering of it. We do not know whether the United States will add designations, whether the findings went to Seoul, or when the 18,270 BTC will move.