Binance bled $3.6B in hours, then its CFO left

In the first few hours after Binance reopened withdrawals, users pulled a net $3.6B out — 57.1% of the entire $6.3B theft, gone again in hours. Eight days after the largest heist in exchange history, the CFO who ran the balance sheet through it is leaving.

What happened

Binance announced on Saturday that chief financial officer Kaiser Ng is leaving after more than five years to "pursue a new venture." Justin Yek, most recently vice-president of finance at Airwallex and formerly an investment banker at Morgan Stanley, takes over immediately. Ng had been CFO since January 2022.

Co-CEO Yi He said in a statement that a transition plan had been "implemented over the last half year." That is Binance's own framing, and there is no independent way to confirm it from outside. What is independently verifiable is the timing: the theft unfolded on October 29, withdrawals were frozen for several days, and the CFO's exit was announced nine calendar days later.

The FBI attributes the hack to TraderTraitor, a North Korea-linked group. Pyongyang denies it. Binance says it, not users, bears the loss.

The balance-sheet math

I covered the recovery numbers in my November 1 piece, and they are the reason the departure matters more than the press release. Here is the position Yek inherits, recomputed from Binance's own figures:

Stolen (Oct 29)                 $6.30B
Net withdrawals, first hours    $3.60B  = 57.1% of the theft
Internal provision              $6.34B  = loss + $0.04B (0.6% cushion)
Frozen / intercepted            $3.00B  = 47.6% of the loss
Still with the hackers           $3.30B  = 52.4% of the loss
SAFU insurance fund used        $0.50B  = 50% of the $1B fund
Replaced so far (95%)           $5.985B ; unreplaced $0.315B

Read those lines together and the story changes shape. The $6.34B provision covers the $6.3B theft with a $40M cushion — 0.6%. That is not a rounding error, it is the whole margin. The $3B "frozen" is not recovered money; frozen is not returned, and $3.3B — more than half the theft — is still in the hackers' hands. And the SAFU fund, the backstop Binance points to when it says users are protected, is half gone after a single event.

Then add the second outflow. The $3.6B that walked out in the first hours after reopening is customer money leaving, not theft — but Binance has to honor it while simultaneously replacing $6.3B of stolen assets. The provision covers the outflow 1.76x on paper, but the provision and the withdrawals draw on the same balance sheet in the same week.

The question isn't whether the exit was planned

Maybe the six-month transition plan is real. A CFO with five years at the world's largest exchange deciding to leave is, on its own, unremarkable. But "planned" and "well-timed" are different claims, and only one of them is checkable from the outside. The checkable part is this: Binance absorbed a $6.3B theft and a $3.6B bank run in the same week, with a $40M cushion and half its insurance fund spent.

Yek's first real test is not a transition plan. It is whether the $3B frozen ever becomes $3B recovered, and whether the $3.6B in hours was the end of the outflow or the start of it. If withdrawals keep running and the frozen funds stay frozen, the arithmetic that matters is not the provision — it is the pace at which customers decide Binance is still the safest place to keep their money.

Sources: TechCrunch, "Binance CFO is leaving to 'pursue a new venture' after $6.3 billion hack" (Nov 7, 2026); Reuters, "Binance CFO Kaiser Ng steps down, Justin Yek named new finance chief" (Nov 7, 2026); Gizmodo (Nov 7, 2026); Binance incident figures as verified in my Nov 1 piece — 95% replaced, $6.34B provision, $3B frozen, SAFU $1B with $0.5B used, $3.6B net withdrawals in the first hours after reopening. All percentages above are my own arithmetic on those published figures.