Binance CFO Kaiser Ng Is Leaving, Company Says Exit Was Planned, Days After $6.3 Billion Hack

Since hackers drained about $6.3 billion from Binance in roughly 20 minutes on Oct. 29, the exchange has frozen withdrawals, reimbursed customers, and drawn an FBI attribution to North Korea. The new development: its chief financial officer is heading out the door.

Binance co-CEO Yi He said in a statement that Kaiser Ng is leaving to "pursue a new venture after more than five years at Binance." She said a transition plan has been "implemented over the last half year." Justin Yek takes over as CFO.

Binance has not said the departure is connected to the hack, and Yi He's account puts the handover planning well before the breach. The departure came barely more than a week after the largest crypto theft on record. No one at the company has offered a different explanation.

How the attack unfolded

Binance's own findings describe a campaign of about five months.

In June 2026, an engineer on the wallet infrastructure team, called Engineer A, searched for a popular AI coding tool and downloaded a tampered installer. Binance's security team caught the anomaly, replaced his device and reset credentials. The attackers had already learned who worked on wallet infrastructure and what they did.

In September, a second engineer, Engineer B, was approached on a legitimate job-search platform by someone posing as a project director. A fake HR representative interviewed him by video. A second interview, with someone claiming to be the CEO of a company that did not exist, ended with a request to download a work assignment. It contained malicious code.

On Oct. 20, the attackers used that machine and an internal Binance AI tool to take over Engineer A's computer and a third employee's, Engineer C. They found Engineer A still held a deployment permission token. On Oct. 29, they used it.

Binance co-CEO Richard Teng has said the malware was built to delete evidence of its own activity, which makes tracing harder.

Who is blamed, and who denies it

Binance and the FBI have both pointed to TraderTraitor, a North Korean group. The FBI said Oct. 31 that it had watched the group converting stolen assets, mostly into ethereum, and expects "further laundering." It asked private-sector crypto service providers to block transactions tied to a list of addresses it published.

The blockchain intelligence firm TRM said it assessed "with high confidence" that TraderTraitor, which investigators have linked to the Lazarus Group, carried out the attack. TRM's Ari Redbord called it "unprecedented" and a "watershed."

"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity," Redbord said. TraderTraitor was also behind last year's $1.5 billion Bybit hack, according to the FBI.

North Korea denies involvement. State-backed media called the accusation a grave political provocation.

Making customers whole

Binance promised that losses would not be passed to users. On Oct. 31, Teng said the exchange had covered 90% of the stolen assets' value using tokens on hand. Later the company said it had replenished 98% of affected tokens and was buying the rest, which it described as less liquid and slower to source at scale. A Nov. 3 explainer put the replacement at 100% by Nov. 2.

The money came from company funds. Binance set aside more than $6 billion, including half of its $1 billion Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. It said it intends to rebuild the fund to about $1 billion. Its balance sheet still shows $157 billion in current total assets.

Binance said it worked with other exchanges and stablecoin issuers to freeze about $2.8 billion of the stolen funds. The remainder was scattered across global networks.

The run on withdrawals

Withdrawals were frozen for several days. When accounts reopened, users pulled out a net $3.6 billion in the first few hours. A separate tally puts customer withdrawals after the hack at $4.7 billion, though that figure also reflects broader market swings.

Bitcoin fell about 5% after the breach was disclosed, dropping below $77,000. Sean Foley, a crypto markets expert at Macquarie University, said a blow to confidence in one of the largest centralized exchanges "risks shocking confidence to many retail investors, which could dampen prices of crypto assets."

Background on Binance's leadership

Binance was co-founded in 2017 by Changpeng Zhao and Yi He. Zhao pleaded guilty in the United States in 2023 to failing to maintain an effective anti-money-laundering program, resigned, served four months in prison, and was pardoned by President Donald Trump last year. Teng and Yi He now run the company as co-CEOs.

What is still open

Binance has promised a detailed technical post-mortem once its investigation is complete. Its findings so far trace the breach to a social-engineering chain that ended with one engineer's leftover credential. That is a controls question the post-mortem will have to answer, and the CFO's exit adds to it.

The FBI has said it expects the stolen assets to keep moving. Whether providers block the listed addresses before the laundering is finished will decide how much of the roughly $3 billion not frozen is ever recovered.