Binance has announced a change in its financial leadership just nine days after suffering the biggest cryptocurrency theft recorded to date, valued at more than $6.3 billion. The company has confirmed that Kaiser Ng will step down as chief financial officer and be replaced by Justin Yek, an executive with experience in the digital payments sector who until now held the Vice President of Finance position at Airwallex. The handover occurs at a particularly delicate moment for the platform, which continues to work to recover the assets that were stolen, strengthen its security systems, and restore the trust of its customers following the cyberattack of October 29.
The company has tried to distance the leadership change from the cybersecurity incident. As explained on Saturday, November 7 Yi He, Binance’s co-executive director, Ng’s departure responds to a professional decision that had been months in the making. "Kaiser Ng has decided to embark on a new project after more than five years at Binance, with a transition plan implemented over the last six months", the platform executive said in a statement cited by Reuters and Bloomberg. The explanation places the start of preparations for the handover well before the hack, although the company has not offered further details about the outgoing executive’s professional future.
Who is Kaiser Ng and why does he leave Binance after the hack
Kaiser Ng has held the position of chief financial officer of Binance since January 2022, after having developed part of his career at Kraken, another of the main cryptocurrency exchange platforms. During his tenure in charge of Binance’s finances, the company has had to face a period of transformation in the digital asset market, marked by greater regulatory requirements and increasing pressure to improve the mechanisms for monitoring and protecting clients.
His departure was announced after the October 29 cyberattack caused significant losses of digital assets and forced Binance to temporarily suspend withdrawals of funds. However, the closeness between the two events does not show that there is a direct relationship between them. The company maintains that the transition had been underway for six months and has not attributed the handover to financial management failures or responsibilities related to the security breach.
Ng has not, for the moment, made any additional public statements about the circumstances of his departure. According to information published by Bloomberg, the executive also did not immediately respond to a request for comment sent via LinkedIn.
Justin Yek, the new CFO of Binance
The CFO position will be taken over by Justin Yek, who until now worked as Vice President of Finance at Airwallex, a company specializing in financial services and international payments. His arrival represents the entry of a professional with experience in the financial management of technology businesses and payment services—two areas especially relevant to Binance’s activity.
"I’m delighted to take on the role of CFO at Binance", Yek said in the statement issued by the company. The new executive also expressed his intention to lead the organization’s finances while the company continues to grow and develop its international operations.
His appointment coincides with a stage in which Binance will have to manage the economic consequences of the cyberattack, complete the replenishment of the affected assets, and deal with increased scrutiny of its internal procedures. However, the company has not announced that the appointment implies a change to its financial strategy nor has it detailed what specific changes the new executive will introduce.
How was the Binance hack carried out that made it possible to steal $6.3 billion
The handover comes after the October 29 cyberattack, which affected approximately $6.34 billion in digital assets, according to the data published by Binance in its preliminary report of November 3.
The internal investigation points to an operation prepared over several months. According to the company, the attackers managed to compromise the devices of several engineers through a combination of malicious programs hidden in software downloads, fake job interviews, and social engineering techniques. Through these access points, they would have obtained credentials and permissions that they later used to intervene in the platform’s internal systems.
Binance explained that cybercriminals managed to access a transaction-signing service for their digital wallets, which allowed them to order unauthorized cryptocurrency movements. During the attack, transfers of assets such as bitcoin, XRP and other tokens were recorded to addresses controlled by those responsible for the operation.
The company also identified the misuse of certain transaction-authorization mechanisms on the Ethereum network. These authorizations complicated containment of the attack, since some transfers could continue to be executed even after suspending ordinary services for withdrawing funds. Binance had to apply additional measures to revoke those permissions and stop the unauthorized movements.
The FBI attributed responsibility for the attack on October 31 of last year to a group of cybercriminals linked to North Korea, an accusation Pyongyang has rejected. The attribution is part of ongoing investigations into the theft, considered the biggest in the sector’s history by the value of the assets stolen.
Binance promises to return the money and says it has already replaced 98% of the affected tokens
One of the main concerns of customers after the attack has been the recovery of the stolen funds. In its report of November 3, Binance stated that it would fully assume the economic impact of the incident and that the losses would not be passed on to users.
The company explained that it had set aside sufficient resources to cover more than 100% of the losses and that, as of October 31, it had replaced 98% of the assets in affected tokens, according to its reserve proof test data. The company noted that it continued acquiring the remaining assets, whose lower liquidity made it difficult to complete the process immediately.
However, it is important to distinguish between restoring customers’ funds and recovering the cryptocurrencies directly from the attackers. Asset restitution can be carried out using the platform’s own resources, while recovery of the stolen money depends on locating, freezing and eventually returning the stolen cryptocurrencies.
In this sense, Binance reported that it had managed to freeze or intercept approximately $2.85 billion in digital assets up to the publication of its preliminary report. This amount was subject to reconciliation and market fluctuations, so it did not necessarily equate to money recovered and definitively available.
To strengthen its systems, the company also announced the rebuilding of the compromised infrastructures, the replacement of affected devices, the deactivation of credentials, and the tightening of access controls. It has also commissioned an independent cybersecurity review and expects to increase investment in anomaly detection tools through artificial intelligence.
The change in direction comes amid a crisis of confidence in the cryptocurrency market
Kaiser Ng’s departure occurs at a time when the security of cryptocurrency exchange platforms is once again under scrutiny. The attack on Binance has highlighted the ability of cybercriminals to use identity spoofing techniques, malicious programs, and advanced technological tools to compromise financial infrastructures.
The incident also forced the platform to introduce temporary restrictions on its operations while it developed containment and recovery tasks. The suspension of withdrawals caused concern among its users, especially regarding the scale of the theft and the technical difficulties described by the company itself in order to stop certain operations.
Justin Yek’s appointment now opens a new phase in Binance’s financial leadership. The company states that the handover had been decided before the hacking and that it responds to Kaiser Ng’s desire to start another professional project, but the timing coincidence places the new person in charge facing the challenge of overseeing the economic consequences of one of the largest cybersecurity incidents recorded in the industry.
For the time being, Binance maintains its commitment to cover client losses and continue collaborating with the authorities to track the stolen funds. The investigation into the attack remains ongoing, while the company will have to complete the recovery of its systems and demonstrate that the security measures implemented are sufficient to prevent new incidents.