Kim Jong-un's sister has personally stepped in to defend North Korea in a $6.3 billion theft case. According to Cointelegraph, Kim Yo-jong, through the Korean Central News Agency (KCNA), denied North Korea's involvement in the Binance theft, calling the US claims "absurd and unoriginal," and implying that the truth would be revealed by examining who ultimately received the recovered funds. However, a blockchain report released the day before tells a different story. Let's recap the background. Hackers began emptying Binance's hot wallets last Thursday evening, stealing approximately $6.43 billion according to Elliptic. The FBI subsequently attributed the theft to TraderTraitor, a North Korean state-backed hacking group, and released hundreds of associated addresses. Blockchain research firm TRM Labs reached the same conclusion. This time, Kim Yo-jong didn't just target Binance; she also denied the $1.5 billion theft from Bybit in February 2025, claiming the US was unfairly blaming North Korea for cybercrime worldwide. The contrast is hidden in the analysis released by Elliptic on Monday. According to Decrypt, the hackers used over 12,000 wallets, 11 chains, and more than 40,000 transactions in less than four days, opening a new wallet on average every 25 seconds. On the main channel, Tron, there were peak hours with approximately 1,300 transactions. Elliptic concluded that this was an automated script running, not AI making decisions, based on fixed time intervals, fixed amounts, blind retries after failures, and intermittent pauses—sounding very much like human activity. TRM also pointed out that the preparation method was very similar to previous North Korea-related cases: first, small withdrawals from Tornado Cash to replenish the wallet; extensive pre-planning; obtaining transaction signatures in advance; and then executing all at once. And then there's her statement, "Let's see who gets the money." Assuming this logic is followed, the figures on the table are as follows: Elliptic estimates that approximately $2.85 billion, or 44%, of the stolen funds has been frozen or seized. The stolen USDT on Ethereum was frozen by Tether 37 minutes after entering the hacker's wallet, and Circle froze all $823 million in USDC before the hacker could redeem it. In contrast, only about 3% of the funds were frozen in the Bybit case. The final fate of these frozen funds is still undecided in reports, but Binance has promised to fully cover user losses. The real problem lies with the remaining half. Elliptic states that approximately $3.24 billion remains in associated addresses, primarily consisting of ETH and the 18,270 Bitcoins that haven't been touched since the day of the incident. Since there's no issuer to freeze ETH and BTC, following Bybit's pattern, it anticipates the hacker will convert the ETH into BTC in small batches and then gradually liquidate it over several months through over-the-counter (OTC) exchanges. I don't think this statement changes anything. The on-chain scripts are still running, and the analytics companies are still marking up each transaction. They say it wasn't them, but the on-chain dynamics tell a different story. Do you trust the on-chain analytics company's evidence more, or do you think Kim Yo-jong's statement, "Let's see who gets the money in the end," has some merit? Other key points for today are shown in the image. Kim Yo-jong, Binance hack, Crypto Daily Briefing