In a significant development for the cryptocurrency industry, Binance’s Chief Financial Officer (CFO), Kaiser Ng, has announced his departure from the company to “pursue a new venture.” This decision comes just over a week after Binance suffered a record-breaking $6.3 billion hack, marking one of the largest financial thefts in history. The timing of Ng’s exit has raised questions about potential connections between his departure and the recent security breach.
The $6.3 Billion Hack: A Multi-Stage Intrusion
On October 29, 2026, Binance reported a sophisticated cyberattack that resulted in the theft of approximately $6.3 billion in cryptocurrency assets. The breach was not a simple phishing incident but a complex, multi-stage intrusion. The attackers employed a combination of social engineering tactics and technical exploits to infiltrate Binance’s systems.
The initial compromise occurred when a Wallet DevOps engineer downloaded a malicious version of the Homebrew package manager while searching for an AI coding tool. Despite Binance’s prompt response, replacing the engineer’s device and rotating credentials, the attackers had already identified key personnel within the wallet infrastructure team.
In September, another engineer was targeted through a fake recruitment process. Posing as a project director from a fictitious company, the attacker conducted interviews and provided a malicious coding assignment. This malware replaced a legitimate component of the Python version-management tool “pvenv” with a malicious version capable of executing commands and communicating with an attacker-controlled server. The malware evaded Binance’s endpoint security tools at the time.
By October 20, the attackers leveraged the compromised devices and an internal AI tool to gain control over additional engineers’ machines. They discovered a container-deployment token stored on one engineer’s computer, which provided the necessary credentials to deploy a container and execute a malicious script. This script accessed Binance’s internal wallet-signing service, allowing the attackers to drain funds from five hot wallets outside the exchange’s normal withdrawal process.
FBI Attribution and Binance’s Response
The Federal Bureau of Investigation (FBI), in collaboration with the U.S. Secret Service and IRS Criminal Investigation, attributed the attack to a North Korean hacking group known as TraderTraitor. The group reportedly converted the stolen cryptocurrency into Ether to launder the funds. North Korea has denied involvement, with government spokesperson Kim Yo Jong labeling the accusation a “sinister attempt” by the U.S. to damage the country’s reputation.
In response to the breach, Binance froze approximately $3 billion of the stolen assets and covered the remaining losses, ensuring that users would not bear the financial impact. The company also implemented a transition plan for Ng’s departure, which had been in place for the past six months, according to co-CEO Yi He.
User Withdrawals and Market Impact
Following the reopening of withdrawals on November 1, Binance experienced a significant outflow of funds. In the first ten hours, users withdrew a net $3.6 billion, with $4.649 billion withdrawn and approximately $1 billion deposited. This rapid withdrawal underscores the erosion of user confidence in centralized exchanges following such a substantial security breach.
The incident has also had broader implications for the cryptocurrency market. Bitcoin, which constituted about a quarter of the stolen amount, is particularly challenging to recover due to its decentralized nature and lack of a central issuer to freeze transactions. The breach has reignited discussions about the need for enhanced security measures and regulatory oversight within the cryptocurrency industry.
What Lies Ahead
The departure of Binance’s CFO, Kaiser Ng, amid the aftermath of the $6.3 billion hack, raises questions about the internal dynamics and leadership stability within the company. While Binance has stated that Ng’s departure was part of a planned transition, the timing suggests that the company is undergoing significant internal changes in response to the breach.
Looking forward, Binance faces the challenge of restoring user trust and implementing robust security measures to prevent future incidents. The company has pledged to cover all losses from the hack, but the process of reimbursing affected users is complex and may take considerable time. Additionally, Binance’s collaboration with law enforcement agencies to trace and recover the stolen funds will be crucial in mitigating the long-term impact of the breach.
For users and stakeholders, the key takeaway is the importance of exercising caution when engaging with cryptocurrency exchanges. The incident highlights the vulnerabilities inherent in centralized platforms and underscores the necessity for users to remain vigilant and informed about the security practices of the services they utilize.
As the situation continues to evolve, stakeholders should monitor Binance’s actions to address the breach, the progress of fund recovery efforts, and any regulatory responses that may emerge in the wake of this unprecedented event.
