By Sophie Lindqvist

A $6.3 billion theft from Binance on Oct. 29 now defines the mandate of incoming chief financial officer Justin Yek, whose first CFO role begins with a control and credibility problem rather than routine finance. Yek succeeds Kaiser Ng, who has held Binance's CFO post since 2022 and is stepping down to pursue a new venture.

Binance, described as the world's largest digital currency exchange, enters the appointment with exposure far beyond routine treasury management. The source provides no breakdown of the stolen assets, affected systems or financial treatment beyond Binance's reimbursement claim.

Binance announced the appointment on Nov. 7, 2026. The source does not identify Ng's new venture. The unanswered issue is whether money can replace confidence in the exchange's internal controls, and those questions now land directly on Yek.

Binance co-CEO Yi He said in a statement that a transition plan had been “implemented over the last half year.” That preparation may reduce succession risk, but it cannot establish whether the controls in place before the attack were adequate.

On Oct. 29, hackers drained an estimated $6.3 billion from the platform, according to Fortune reporter Jeff John Roberts. The episode was described as the biggest heist in crypto history.

Binance later attributed the attack to North Korean hackers. They used social engineering, the manipulation of people, and malicious software to compromise engineers and gain access to systems that enabled unauthorized withdrawals.

Tether and Circle froze about $2.5 billion in stolen stablecoins, limiting part of the immediate loss. Binance says it replenished 98% of the stolen coins through reserve funds and other sources.

The company also says users “won't bear the losses,” a commitment that places the remaining burden on Binance and its reserves. That statement addresses reimbursement rather than the security failure or broader questions about internal controls.

The source does not identify the “other sources” used for replenishment or quantify the remaining 2%. It also gives no detail on the systems compromised, the engineers affected or the specific control changes. Those omissions matter because reimbursement does not establish that the underlying exposure has closed.

Cybersecurity now sits within the CFO remit because lost assets, customer remediation (compensating affected customers), regulatory scrutiny and reputational damage can converge on finance leadership. Deloitte's Q3 2026 CFO Signals survey supports that framing: 50% of finance chiefs ranked cybersecurity as their top external concern, ahead of the economy and inflation.

Yek brings substantial corporate-finance and transaction experience, although the CFO title is new to him. At Airwallex, he rose from head of strategic finance and corporate development to vice-president of finance, where he led the global finance team.

Before Airwallex, he spent about nine years in investment banking at Citi and Morgan Stanley. His LinkedIn profile says he worked on more than $30 billion of equity, mergers and acquisitions, and debt transactions.

Those credentials suit a growing financial technology company managing capital, scale and regulatory demands. Yet Yek lacks the crypto-exchange experience Ng brought after joining Binance from Kraken. Corporate finance can strengthen governance; it cannot substitute for operating knowledge of an exchange.

The contrast matters because Yek's mandate combines financial oversight with operational-security accountability. He inherits an exchange that has contained much of the loss but still needs to persuade customers and regulators that their assets are safe.

What does this change for Binance users?

For users, the immediate financial answer is direct: Binance says it replenished 98% of stolen coins and they will not bear the losses. The strategic effect remains uncertain because reimbursement does not, by itself, demonstrate stronger controls or restore trust.

For Binance, Yek's first task is evidence rather than reassurance. He must show how the breach occurred, which controls failed, what changed and whether regulators accept that account. Without that evidence, compensation can settle a balance sheet, but it cannot settle the trust deficit.