Binance Replaces CFO Kaiser Ng as Hackers Spread Stolen Funds Across 10,000 Wallets

Co-chief executive Yi He said in a statement that Ng had "decided to pursue a new venture after more than five years at Binance", and that a transition plan had been "implemented over the last half year". Binance did not connect the departure to the theft. Ng has been chief financial officer since January 2022 and previously worked at the rival exchange Kraken, according to Reuters. Yek was most recently vice president of finance at the payments company Airwallex and is a former Morgan Stanley and Citi banker, Reuters reported.

The new finance chief arrives as Binance covers the cost of what Reuters described as a record crypto heist. The exchange has said it will reimburse affected customers in full. "Binance will bear the financial impact of the stolen funds," the company said, adding: "These losses will not be passed on to users." Binance froze withdrawals for several days after the attack, and once accounts were unfrozen users took out a net $3.6 billion in the first few hours, TechCrunch reported.

Binance says the breach began on October 29, after malware hidden in software downloads and fake job recruitment approaches were used to target its engineers. The intrusion built up over months, starting with the compromise of several employees' computers, according to the company's account as reported by Reuters. Binance and the FBI have blamed a North Korean hacking group known as TraderTraitor. Pyongyang denies involvement.

The trail of the stolen money is becoming clearer. The attackers split the funds across more than 10,000 digital wallets and moved portions through services that swap assets between blockchains, according to a Wall Street Journal investigation published on November 7 and summarised by Gulf News. Blockchain analytics firm Chainalysis found that more than $46 million passed through the cross-chain protocol THORChain in the first 72 hours after the attack, generating more than $200,000 in fees for its operators, the Journal reported. Nearly $4 million went through Wasabi Wallet, a Bitcoin privacy service built to make transactions harder to trace.

The FBI asked crypto service operators, including those running THORChain nodes, to block transactions tied to the theft, but some continued. Developers associated with decentralised services have argued that their systems are not designed to give anyone central control over individual transactions, a position that leaves open who is responsible when such networks carry stolen funds.

A separate analysis released the same day by blockchain intelligence firm Bitquery traced about $333 million that was laundered or moved towards cash-out services in the first week after the breach, including about $208 million within the first two and a half days. Bitquery put roughly $113 million of that through THORChain. Its study covered nine blockchain networks and used a different period and method from the figures cited by the Journal, so the two sets of numbers cannot be added together. Bitquery also found that much of the stolen Bitcoin and Ether was still sitting in identifiable wallets.

Stablecoin issuers and other organisations have frozen a large share of the loot. About half of the stolen funds had been frozen, according to the Journal, while tracing firms estimated that the attackers still controlled nearly $3 billion. A freeze stops assets from being moved but does not return them to Binance or to their owners, so how much of the $6.3 billion the exchange eventually recovers, and how much it must fund itself, is still unknown.