Binance CFO Leaves After $6.3 Billion Hack as Justin Yek Takes Over

Binance's finance chief is stepping down just over a week after a record cryptocurrency theft. Here is what the company said about the leadership change, the $6.3 billion hack, and why developers should care.

Binance, the world's largest cryptocurrency exchange, said its chief financial officer (CFO), Kaiser Ng, is leaving the company. A CFO is the person who leads a company's money and finance work—budgets, reports, and major money decisions.

The announcement came on Saturday, Nov. 7, 2026, just over a week after Binance said hackers stole $6.3 billion in cryptocurrency. Binance Co-Chief Executive Officer Yi He said Ng is leaving to pursue a new venture, and that a handover plan had already been running for about six months.

Who is leaving, and who is next?

Kaiser Ng has been Binance's CFO since January 2022. Before that, he worked at Kraken, another major crypto exchange.

Binance named Justin Yek as the new finance chief. Yek is a longtime finance executive. His most recent role was vice president of finance at Airwallex, a payments company.

"Kaiser Ng has decided to pursue a new venture after more than five years at Binance, with a transition plan implemented over the last half year."
Yi He, Co-Chief Executive Officer, Binance

In plain words: Binance says Ng chose a new path, and the company had already been preparing for the change for months. The statement did not say exactly when Ng's last day is, or what his next project will be.

Timing note: the leadership news and the hack are close together in time. Binance says the CFO handover plan began about six months earlier—before the Oct. 29 theft. Readers can keep both facts in view without assuming one caused the other.

What happened in the $6.3 billion hack?

A cryptocurrency exchange is like an online marketplace where people buy, sell, and store digital money such as Bitcoin. When an exchange is hacked, attackers try to move that digital money into accounts they control.

Binance said the breach unfolded on October 29, 2026, and that hackers stole cryptocurrency in a sophisticated attack. The company has described it as a record-size theft.

According to Binance, the attack did not start on that single day. It began months earlier when several employees' computers were compromised. Binance said the break-in started with:

Malware in software downloads: malware is harmful software that can secretly take control of a computer or steal information.
Fake job recruitment aimed at engineers: attackers pretended to offer jobs so they could trick technical staff.

Binance said it will fully reimburse affected customers. That means the company says customers should not be left holding the loss from the stolen funds.

What investigators have said so far

The FBI has blamed a North Korean hacking group for the theft. North Korea has denied the allegation. Investigations into large crypto thefts often continue for months, so more details may still appear later.

Why a finance leadership change matters

After a huge loss of funds, people naturally watch how a company handles money, customer refunds, and risk. A CFO helps lead that work. Naming a new finance chief can signal that Binance wants a steady hand for the next chapter, especially while customers, regulators, and partners watch the recovery.

For everyday users, the clearest company promise so far is the pledge to cover affected customers. For builders and security teams, the clearer lesson sits in how the attackers first got in: through people, downloads, and trust—not only through a broken website form.

What It Means for Developers

This story is about money and leadership, but the reported attack path is a developer story too. Attackers focused on engineers and work computers. That makes everyday coding habits part of the security picture.

What It Means for Software Developers

Fake job offers that ask you to download and run a coding "assignment" are a known social-engineering trick. Social engineering means tricking a person instead of breaking a lock with pure technical force.

Practical habits that match the reported risk:

Treat unexpected interview tasks that require installing software on a work laptop as high risk.
Prefer a clean personal test machine, a virtual machine, or a disposable cloud environment for unknown sample projects.
Never paste secrets, API keys, wallet keys, or deployment tokens into code you did not write and do not trust.
If a recruiter asks you to disable security tools "just for the interview," stop and report it.

If you build or review interview take-home projects at your company, keep them in sandboxed repos and document what candidates should not run on corporate devices.

What It Means for DevOps Engineers

Once malware lands on an engineer laptop, attackers often look for the next step: cloud logins, deployment tokens, container permissions, and internal tools. That is why DevOps and platform teams care about least privilege and fast credential rotation.

Give deployment credentials the smallest permissions needed, and expire them often.
Alert on unusual container or production deploys from unexpected machines or accounts.
Separate daily coding devices from systems that can move funds or change production wallets whenever possible.
Practice incident drills: revoke tokens, rebuild affected hosts, and check audit logs quickly.

Guides such as AWS security groups and AWS WAF help lock down network and web edges. They do not replace endpoint security or safe hiring workflows, but they are part of a layered defense when you deploy apps on cloud infrastructure.

What It Means for Backend and Full-Stack Developers

Backend and full-stack developers often hold access to payment services, admin APIs, and privileged dashboards. A compromised laptop can become a key to those doors.

Use short-lived tokens and role-based access for admin routes in Express and Node.js apps.
Keep production secrets out of local .env files whenever a secrets manager is available.
Log privileged actions so a team can see who moved money, changed wallets, or shipped risky config.
Review dependency installs and unknown scripts before running them, especially from zip files or interview repos.

Simple rule: if a stranger asks you to run their code to "get the job," treat that code as untrusted software—because that is exactly what the reported Binance entry path used against engineers.

What to watch next

A few open points remain after the announcement:

Exact handover dateBinance has not publicly pinned Ng's final day in the statement summarized here.
Recovery progressWatch how customer reimbursements and frozen stolen funds are handled over time.
Security follow-upLarge breaches usually lead to deeper incident reports, device rebuilds, and process changes for engineering teams.

Bottom line

Binance is changing finance leadership: Kaiser Ng is leaving after more than five years, and Justin Yek is stepping in as CFO. The company says the transition was planned over the prior half year.

The news lands soon after a $6.3 billion theft that Binance linked to compromised employee computers, malware in downloads, and fake recruitment aimed at engineers. For users, the key company promise is full reimbursement. For developers, the lasting lesson is clear: hiring scams and untrusted code on work machines can become an entry point for attacks that later turn into massive financial damage.