Binance Swaps CFOs While Absorbing a $6.3 Billion Hack Loss

- November 07, 2026

The exchange says the handover was planned months ago. The timing still puts a new name on the accounts paying for the biggest crypto theft on record, backed by recovery figures nobody outside Binance has checked.

Binance's chief financial officer, Kaiser Ng, is leaving the exchange, Bloomberg reported and TechCrunch followed up on November 7. Justin Yek will replace him. The news lands nine days after hackers drained $6.3 billion in crypto from Binance wallets on October 29, a loss the company has said it will cover out of its own pocket.

In a statement, co-CEO Yi He said Ng was leaving to "pursue a new venture after more than five years at Binance." What that venture is has not been disclosed.

Binance says the exit was six months in the making

Yi He also said a transition plan had been "implemented over the last half year." Read plainly, that means Ng's departure was settled well before the breach, and nothing made public so far contradicts it. I have no reason to treat the explanation as cover.

The timing still matters, because of what the finance team is now carrying. Since the first days after the theft, Binance has repeated one line: "These losses will not be passed on to users." That is a balance-sheet promise, and the person ultimately accountable for the balance sheet is about to change.

The numbers moved every few days

Few big incidents have produced figures that shifted this fast. On October 30, The New York Times put the estimated damage at around $6.3 billion, easily above the $1.5 billion Bybit hack in 2025. Roughly $3 billion had been frozen on-chain by then, and Binance said it would cover losses with SAFU, its emergency fund for users, plus company money.

By October 31, the CEO said 90 percent of the stolen funds had been replaced. As we wrote at the time, "replenished" meant bought back on the open market, not recovered from the attackers. On November 1, the figure was 95 percent, and withdrawals began coming back in phases by network and asset. In its postmortem, published November 3, Binance put total impacted assets at $6.34 billion, with $2.85 billion frozen and 98 percent of the affected token assets replenished.

Each step up in that percentage represents more of Binance's own money spent. The company said the remainder consists of less liquid tokens that take longer to source at scale.

The first day of withdrawals was the real stress test

A promise to make users whole is one thing. Watching how many users leave anyway is another. Between 6 a.m. and 3:30 p.m. UTC on November 1, Binance processed $4.6 billion in withdrawals against $1.0 billion in deposits, according to its own figures. The net outflow of $3.6 billion came to 2.1 percent of its total assets under management.

That 2.1 percent figure is the company's framing, and on its face the exchange absorbed the run. But the $3.6 billion is separate from the hack loss. It is customer money that walked out the door, and it will sit in the first financial picture Yek is responsible for.

How a laptop became a $6.34 billion problem

The postmortem describes a campaign that ran for months rather than a single bad night. In June, a wallet DevOps engineer downloaded a tampered installer found through a search engine. Binance caught the anomaly, but the attackers had already learned about the engineer's colleagues.

In September, a software engineer was approached through a job-hunting platform by someone posing as a "Project Director." Two interviews followed: a video call with a fake HR representative, then a chat with a supposed CEO who sent an assignment file carrying malware. On October 20, the attackers used that engineer's machine and an internal AI tool to take over the computers of two more engineers. On October 29, they used stolen credentials to move the money.

The FBI and Binance have attributed the attack to TraderTraitor, a North Korean group. Binance says it has since rebuilt its wallet system, replaced devices, rotated credentials and added AI-powered anomaly detection.

None of that is the CFO's job in a narrow sense. Yet the cost of each remediation step, along with the token purchases, flows through the same accounts.

What Justin Yek inherits

The central weakness in the public record is that every recovery figure so far comes from Binance itself. The 90, 95 and 98 percent numbers have not come with independent verification attached. On October 30, the company said it would "publish an updated proof of reserves once the remediation is complete." Whenever that report arrives, it will be the first outside-checkable look at the books after the hack, and it will arrive on Yek's watch.

The frozen $2.85 billion is the other open question. Whether those funds are ever released, and whether they would go toward repaying Binance for the tokens it already bought, has not been made public.

There is a limit to what a CFO change tells us. Binance's explanation of a planned handover is plausible, and reading the departure as a reaction to the breach would be guesswork. What can be said is narrower. Binance chose to turn a theft of user funds into a corporate expense, and the executive who signs off on that expense is now someone who started the job after the decision was made.

---

Sources

Search This Blog

Omni Topic - Tech