G7 Reaffirms North Korea Denuclearization Goal and Calls for Joint Action on Crypto Theft

Paris talks connect nuclear threats with stolen digital money

G7 foreign ministers called for a coordinated response to North Korea's cryptocurrency thefts while reaffirming their commitment to its complete denuclearization during talks in Paris on November 9, 2026. The meeting brought nuclear weapons, ballistic missiles, cyber operations and the abduction of foreign nationals into the same diplomatic discussion.

Japan's Ministry of Foreign Affairs said the session began at 12:15 p.m. local time and lasted approximately 90 minutes. Its official meeting summary records both a condemnation of North Korea's unlawful nuclear and ballistic missile programs and agreement on the need to address its malicious cyber activities together.

The talks followed an October 31 announcement in which the FBI attributed the theft of more than $6 billion from cryptocurrency exchange Binance to North Korea. The amount was put at approximately $6.3 billion in more detailed accounts. Pyongyang denied involvement.

Japanese Foreign Minister Toshimitsu Motegi asked other G7 governments to coordinate policy on North Korea's nuclear and missile development, cryptocurrency thefts and abductions. Ministers also urged North Korea to resolve the abduction issue immediately.

The G7 meeting ran from November 9 to 10. Foreign ministers from Britain, Canada, France, Germany, Italy, Japan and the United States participated, alongside the European Union's foreign affairs and security policy high representative. South Korea attended the wider gathering at France's invitation.

What the ministers agreed on North Korea

The G7 kept complete denuclearization, in accordance with United Nations Security Council resolutions, as its stated goal. In simple terms, the ministers maintained that North Korea should give up its nuclear weapons program, while also condemning its ballistic missile development.

Japan's ministry described the ministers' position on cyber operations in these words:

They further expressed the need to address together North Korea's malicious cyber activities, including cryptocurrency thefts.

The Paris statement set out a common political position. It gave no timetable for new sanctions, a joint investigation or a mechanism for recovering stolen cryptocurrency. For governments and financial companies, the immediate focus therefore remained cooperation under existing sanctions and efforts to interrupt the movement of stolen assets.

Motegi also thanked other G7 members for their cooperation on the abductions issue. Keeping that demand alongside nuclear and cyber concerns preserved attention on the Japanese and other foreign nationals abducted by North Korea, rather than limiting the discussion to weapons and money.

How the Binance theft entered the debate

The FBI's October 31 attribution gave the cyber discussion a concrete financial backdrop. U.S. investigators urged the cryptocurrency industry to block transactions involving identified wallet addresses or funds originating from them. A wallet address is a destination used to receive or send digital assets.

Japan's account of the G7 session discussed cryptocurrency thefts broadly and did not name Binance. The specific allegations about that exchange came through the U.S. investigation and subsequent accounts of the incident.

A Foundation for Defense of Democracies analysis, by Mathew Ha and Annie Fixler, says the FBI attributed the attack to the North Korean group TraderTraitor. It describes approximately $6.3 billion being drained from wallets belonging to Binance in about 20 minutes at the end of October.

Ha, an adjunct fellow at the foundation's Center on Cyber and Technology Innovation, and Fixler, the center's director, describe the incident as the largest cryptocurrency theft in history. They compare it with the $1.5 billion stolen from Bybit in February 2025. Using those figures, the Binance theft was about 4.2 times as large.

Frozen funds and Binance's promise to users

About $2.7 billion in stablecoins was frozen within approximately three hours, according to the foundation's analysis. That represents roughly 43 percent of the stated $6.3 billion theft. Freezing assets stops them from being moved or spent while they remain subject to the restriction.

Stablecoins are digital tokens designed to maintain a steady value, commonly against the U.S. dollar. Some issuers can freeze their tokens, giving investigators and companies a way to interrupt transfers after a theft. Other cryptocurrencies operate differently, making recovery dependent on the asset and the services handling it.

Binance said it had replaced 90 percent of the stolen amount and was committed to covering the remaining 10 percent. The company also said users would not bear the financial impact. The foundation's account says the targeted wallets belonged to the exchange itself.

Binance's replacement of assets addresses its financial obligations, while freezing and tracing stolen funds addresses where the money goes. Those processes can run at the same time. Investigators try to stop criminals from spending the proceeds even as a company restores its own reserves.

Why the money matters beyond cryptocurrency markets

Lee Ho-ryung, a senior research fellow at the Korea Institute for Defense Analyses, estimated that $6.3 billion was equivalent to roughly one sixth of North Korea's annual national income. Lee also put the country's exports in the previous year at approximately $420 million to $430 million.

On those estimates, the stolen sum was roughly 15 times North Korea's annual export earnings. That comparison helps explain why governments discuss digital theft alongside weapons development: a single operation can involve far more money than the country earns from selling goods abroad in a year.

Lee said North Korea must buy components and pay for factories to produce weapons. South Korean foreign ministry spokesperson Park Doosoon likewise identified illegal cyber activities as a source of funding for North Korea's nuclear and missile programs and a threat to the global digital economy.

An October 2025 multinational sanctions monitoring report described North Korea laundering stolen cryptocurrency and converting it into cash through overseas brokers, including in China, Russia and Cambodia. Laundering means moving or disguising criminal proceeds so they become harder to trace.

The foundation's analysis describes transfers through multiple wallets, different cryptocurrencies and mixing services, which combine transactions to obscure their origins. It also cites a March 2024 warning by a United Nations expert panel that cryptocurrency thefts help finance North Korea's development of weapons of mass destruction.

Washington presses for action while Seoul reviews options

A U.S. State Department spokesperson called for governments to cooperate against North Korean cyber threats and illegal revenue generation following the Binance incident. The spokesperson urged all U.N. member states to enforce existing sanctions and prevent money from reaching prohibited weapons programs.

The spokesperson described coordinated national sanctions as one tool for interrupting that financing:

Coordinated unilateral sanctions continue to be a strong tool to prevent the flow of money that supports the proliferation of weapons.

National sanctions are restrictions imposed by an individual government, such as asset freezes or transaction bans. Governments can coordinate them so that several jurisdictions restrict the same people or businesses, narrowing the places through which money can move.

South Korea's unification ministry said Seoul had not begun discussing sanctions over the incident because the circumstances of the theft had not been fully established. Its foreign ministry was reviewing possible additional measures, including cyber sanctions, but had made no decision. Washington did not disclose whether it had shared investigative findings with Seoul or discussed additional sanctions bilaterally.

Seoul connects European and Asian cyber security

South Korean Foreign Minister Cho Hyun discussed North Korea with U.S. Secretary of State Marco Rubio during a separate conversation at the Paris gathering. They agreed to close cooperation on bilateral relations, including progress on agreements between their leaders.

Cho also met French Foreign Minister Jean-Noel Barrot on November 9. Their discussion covered the Korean Peninsula and other international issues, with both supporting multilateral cooperation and an international order based on international law.

The cyber discussion continued in Vienna on November 10 at a conference jointly hosted by South Korea and the Organization for Security and Co-operation in Europe. Vice Foreign Minister for Strategy and Intelligence Jeong Yeon-doo said cryptocurrency thefts had consequences for international security beyond the criminal acts themselves.

Jeong called for a broad rethink of cyber defenses as artificial intelligence enables attacks at greater speed and scale. About 100 people attended, including representatives from Japan, Australia, Thailand, Afghanistan and Qatar, alongside specialists and international organization officials. South Korea has held the conference annually since 2017.

South Korea's military estimates North Korea's cyber force at approximately 8,400 personnel, an increase of around 20 percent in two years. Jeong also stressed the connection between security in Europe and the Indo-Pacific, echoing a theme Motegi raised in Paris.

A wider regional agenda and renewed border tensions

Motegi told the Paris session that security in Europe, the Atlantic and the Indo-Pacific was indivisible. The G7 opposed unilateral attempts to change existing conditions by force or coercion in the East China Sea, South China Sea and across the Taiwan Strait.

Rubio and Motegi separately agreed to advance security cooperation aimed at strengthening the deterrence and response capabilities of the U.S.-Japan alliance. Deterrence means trying to prevent an attack by convincing a potential attacker that it would face serious costs.

The working lunch also covered Africa, Latin America, global governance and economic security. Ministers agreed to work together on challenges including economic coercion and arbitrary export restrictions. World Food Programme Executive Director Luke Lindberg attended part of the session.

On the Korean Peninsula, diplomatic exchanges unfolded alongside concern about tensions near the Demilitarized Zone. On November 5, U.N. spokesperson Stephane Dujarric said Secretary-General Antonio Guterres was concerned about the risk of escalation and wanted communication channels restored to prevent accidental clashes and miscalculation.

North Korean Workers' Party official Kim Yo Jong responded on November 10 by accusing Guterres of favoring South Korea. She described North Korean fortification work near the military demarcation line as defensive construction on its own territory and claimed the U.N. chief would share responsibility if a military clash occurred.

The sequence from investigation to diplomacy

The developments stretched across nearly two weeks, moving from a criminal attribution to discussions about sanctions, weapons financing and regional security.

• October 31: The FBI attributed the Binance cryptocurrency theft to North Korea and urged action to block related transactions.
• November 5: The U.N. secretary-general's spokesperson expressed concern about tensions near the Demilitarized Zone and called for restored communication.
• November 7: A U.S. State Department response called for international cooperation against North Korean cyber threats and illegal revenue.
• November 9: G7 ministers discussed North Korea during the Paris session on crises and international challenges.
• November 10: The Paris gathering concluded, Kim Yo Jong criticized the U.N. secretary-general, and South Korea addressed cyber threats at the Vienna conference.

The common thread was the effort to restrict North Korea's access to money while maintaining pressure over its weapons programs. The parallel U.N. appeal focused on restoring communication to reduce the immediate danger of a border incident.

Key Points

• G7 ministers reaffirmed complete North Korean denuclearization under U.N. Security Council resolutions.
• The November 9 Paris session called for a joint response to malicious cyber activities, including cryptocurrency theft.
• The FBI attributed the Binance theft, valued at about $6.3 billion, to North Korea, which denied involvement.
• About $2.7 billion in stablecoins was frozen, according to the Foundation for Defense of Democracies analysis.
• Binance said it would cover the losses so users would not bear the financial impact.
• South Korea was reviewing possible additional measures but had made no sanctions decision.
• Ministers also demanded an immediate resolution of North Korea's abductions of foreign nationals.