Binance CFO Kaiser Ng Departs Amid Reported $6 Billion Heist

Binance chief financial officer Kaiser Ng is leaving the exchange to start a new venture, co-chief executive Yi He said in a statement on November 7, days after hackers stole about $6.3 billion from the platform. Justin Yek takes over as finance chief.

The statement says the handover followed a transition plan put in place over the past six months. That timing matters for how finance professionals read the news, because the theft happened on or about October 29, according to the FBI, and the two events should not be treated as cause and effect without evidence.

For finance teams, the practical questions are different. They are how an exchange funds a loss of this size, how quickly customers are made whole, and what the incident says about control environments at any firm that holds client assets or uses crypto rails. Traders also watch the Binance funding rate on perpetual futures for signs of stress, and that gauge belongs in the same conversation.

What Binance said about the CFO change

Yi He said Ng “has decided to pursue a new venture after more than five years at Binance, with a transition plan implemented over the last six months.” She added that the company wished him well in his next chapter.

Yek, who most recently served as vice president of finance at payments company Airwallex, has also worked at Citi and Morgan Stanley. Ng previously spent five years at rival exchange Kraken.

“I am thrilled to step into the role of CFO at Binance. I look forward to leading our finance organization as we continue to scale responsibly and deliver on our mission globally.” Justin Yek, incoming chief financial officer, Binance

Binance has not said the departure is connected to the theft, and nothing in the company’s statement suggests it is. A six-month transition plan predates the October 29 incident by a wide margin.

What the statement does not provide is a departure date for Ng or a start date for Yek. Neither has been disclosed.

The $6.3 billion theft and the FBI finding

The Federal Bureau of Investigation said in an alert dated October 31 that North Korea was responsible for the attack on Binance, which it put at more than $6 billion. The FBI identified the actor as TraderTraitor, the same label it used for the $1.5 billion theft from the Bybit exchange in February 2025.

The FBI said, working with the US Secret Service and the Internal Revenue Service Criminal Investigation unit, that the stolen funds were mostly converted to ether. It expects further laundering through decentralised finance protocols and instant swap services.

The agencies asked private-sector operators, including node operators, instant exchanges and blockchain analytics firms, to block transactions linked to the laundering addresses. The full alert is on the FBI website.

North Korea has denied involvement. Kim Yo Jong, sister of leader Kim Jong Un, called the attribution a “grave political provocation” in remarks carried by state media.

Binance said the breach began with a fake job interview. An employee’s computer was compromised, which gave the attackers access to an internal service and, from there, the exchange’s wallet infrastructure.

The exchange has said the campaign ran for months before the funds were taken. That is the detail finance and security leads should weigh most heavily, since it describes an intrusion that routine controls did not catch.

How Binance is covering customer losses

Binance has said users are being protected from immediate losses. The company said it had covered about 90% of the $6.3 billion, with work continuing to reimburse customers in full.

The funding for that effort comes from the Secure Asset Fund for Users, known as SAFU, and from company resources. SAFU is the reserve Binance created in 2018, funded from trading fees.

The reimbursement rate is the figure to track. Binance has also said it has frozen part of the stolen funds, though reported totals vary between sources and Binance has not published a single reconciled figure that this article can confirm.

The Bybit precedent is instructive. Bybit lost $1.5 billion in February 2025 and the FBI attributed that theft to the same North Korean operation. The Binance loss is more than four times larger.

This article could not confirm any Binance proof-of-reserves disclosure tied to the theft, and none is described in the company statements reviewed. Customers and counterparties should look for an attestation of customer liabilities against assets, rather than relying on a reimbursement percentage alone.

What the Binance funding rate does and does not show

A funding rate is the periodic payment between traders holding long and short positions in a perpetual futures contract. It is designed to keep the contract price close to the spot price.

The Binance funding rate is published for each contract on the exchange’s futures pages. A strongly positive or negative reading shows one-sided positioning, and sharp moves can signal stress among leveraged traders.

It is a market indicator, not a measure of the exchange’s solvency. Finance teams with crypto exposure should treat the Binance funding rate as one input beside reserve attestations, withdrawal behaviour and regulator statements.

No source reviewed ties any movement in the Binance funding rate to the CFO change or to the theft, and this article does not suggest a link.

What finance teams should take from the Binance case

An attack that starts with a job interview is a human-process failure before it is a technical one. Firms of every size run recruitment, contractor onboarding and developer tooling, and each is a path into internal systems.

Accounting practices and finance departments can test their own readiness. An incident response plan template sets out who decides what in the first hours. A written information security plan template covers the controls an attacker would have to defeat.

The financial side matters as much. A business continuity plan template forces a firm to decide how it keeps paying staff and filing returns if systems are locked or client money is frozen.

The Binance reimbursement shows the other half. An exchange with a large reserve fund and parent-company resources can absorb a loss of this size, and a small exchange or a small firm usually cannot. Finance leaders choosing counterparties should ask where the loss would land.

The finance chief’s role is also changing in response. Our guide to the CFO technology stack covers the tools finance leaders are deploying, and security monitoring now sits close to that list.

What to watch at Binance next

The first test for Yek is the completion of customer reimbursement, which Binance has said it is working to finish after covering about 90% of the loss. The next is whether the exchange publishes an independent attestation of reserves.

The FBI’s request to block transactions tied to the laundering addresses will show over the coming weeks how much of the stolen ether can be frozen before it leaves the system.