Binance reopened withdrawals for its customers on Sunday after spending more than 48 hours under a defensive lockdown triggered by the largest hacking attempt in digital financial market history. Within just a few hours of reopening, the platform recorded a net outflow of $3.64 billion in deposits.
What Happened to Binance on Sunday?
Binance restored fund withdrawals in controlled phases on Sunday, November 1, 2026, two days after freezing operations to contain a coordinated breach. The offensive attempted to drain more than $6 billion in assets—an episode confirmed as real by the U.S. FBI, which preliminarily attributed it to North Korean cyber espionage groups.
The return of transfers began with Bitcoin customers after 2:00 p.m. Singapore time and expanded to a basket of 15 priority tokens, including Ether, Tether’s USDT, and Circle’s USDC. Around 7:30 p.m., the company extended the rollout to 12 distinct blockchain networks, unlocking ecosystems such as BNB Smart Chain, Ethereum, Base, and XRP.
The temporary shutdown and subsequent unlocking took place as the market monitored the company's solvency developments, as detailed in our coverage on how Binance organized its asset replenishment schedule to avoid liquidity distortions between trading pairs.
Total volume withdrawn by users during Sunday morning's window.
Inflows maintained on the platform even amid an environment of distrust.
Final net balance withdrawn, representing 2.1% of the group's $171 billion in custody.
Despite the massive volume redeemed, the exchange communicated via its social media channels that outbound flows cooled over the course of the afternoon and began to stabilize within technical parameters set by its risk desk.
How Big Was the Breach and What Is the Company's Payment Capacity?
The $6 billion theft attempt easily surpassed the previous record set by the Bybit exchange in 2025, establishing a precedent four times more severe in terms of financial value placed at risk. However, accounting figures released by the exchange itself show that its capital base withstood the first wave of stress without resorting to permanent artificial limits.
The $3.64 billion in net withdrawals corresponds to 2.1% of the total declared portfolio under custody, valued at $171 billion. The fact that the institution absorbed an initial bank run without suspending primary conversions indicates that its fractional reserve structure and immediate liquidity operated within the safety margins outlined in its contingency protocols.
Even so, the episode brings immediate political repercussions. Former President Donald Trump stated publicly that he is reviewing the breach and noted that there is still no definitive proof regarding the attribution to North Korean operatives, diverging from the formal stance presented by federal investigative agencies.
Why Did the Exchange Justify a Phased Rollout?
In an official statement posted to its X profile, Binance explained that the gradual reopening was designed to prevent congestion on decentralized bridges and allow each network pair to undergo comprehensive cybersecurity scans before releasing new external transfer orders.
“Binance is adopting a phased approach, prioritizing tokens based on user demand data from the past week, so that each network pair and asset can be restored carefully, with stability and security checks completed before access is reopened.” Official Binance statement on X
By prioritizing high-volume tokens such as Bitcoin and stablecoins USDT and USDC, the exchange sought to defuse a domino effect in the spot market. As the system resumed accepting orders, Bitcoin held steady at $77,800.46, trading up a modest 0.47% on the day and showing resilience following the initial impact described when the attack on Binance pressured Bitcoin prices.
If you keep funds on the platform, the first stress test of operational solvency has passed: the company had sufficient net cash to honor massive withdrawals. However, keeping reserves on centralized exchanges transfers all security risk to third parties. This is an opportune moment for an immediate review: funds earmarked for long-term strategic reserves should be transferred to cold self-custody wallets, keeping only the capital strictly necessary for immediate trading activity on the exchange.
What to Watch From Here On
The system's apparent normalization does not end the crisis of confidence. The coming days will be decisive in measuring whether deposit flight continues at a residual pace or if a second wave of transfers will materialize as institutional investors reassess their allocations to centralized counterparties.
Reserve Stability — Monitor whether daily withdrawals remain below the 3% to 5% range of assets under custody, which preserves routine operations without requiring the liquidation of open-market positions.
The FBI’s Official Investigation — Watch for potential regulatory sanctions or restrictive measures from U.S. authorities if compliance failures facilitated the hacker access.
The Full Reimbursement Commitment — Verify whether the formal promise to cover any balance shortfalls will be executed via corporate safety funds without diluting user balances.
The Verdict: Immediate Relief Does Not Eliminate Counterparty Risk
The reopening of withdrawals averts the worst-case short-term scenario: the disorderly shutdown of operations at a $171 billion institution. The fact that it processed $4.64 billion in redemptions within a few hours attests to its immediate liquidity strength. For retail investors, however, the attack reinforces a fundamental rule of the crypto ecosystem: an exchange is not a savings account. The flexibility of trading on the platform comes with the price of cyber risk, and definitive asset security remains with self-custody.
