It's not an exclusive statement. The safe bet is that both the NSA and other spy agencies around the world have been using the openSSL hole.

If the NSA has not, they're incompetent.