Binance will restart customer withdrawals in phases on Sunday, two days after attackers tried to pull more than $6 billion out of the exchange in what Reuters described as the biggest cyber theft ever recorded. The company said it recovered the bulk of the stolen funds before reopening the withdrawal queue, according to Reuters and Bloomberg reports posted on November 1, 2026.
The sequencing is the story. Binance is not switching withdrawals back on all at once. A phased restart lets the exchange meter outflows, confirm that recovered assets are back under its control, and watch for follow-on attempts before the full customer base regains access. It reads as caution, not confidence restored.
A theft measured in billions, then clawed back
The scale is the headline. More than $6 billion in a single incident puts this above any prior exchange breach on record, per the Reuters and Bloomberg reports. That Binance recovered most of it within roughly 48 hours is the rarer part. Large crypto thefts usually end with funds scattered across mixers and bridges and written off, not returned to the victim inside two days.
A fast, partial recovery also changes the solvency math. A $6 billion loss that sticks would be a systemic event for the largest exchange in the market. A $6 billion loss that is largely reversed is closer to a scare, and the phased withdrawal plan suggests Binance believes it can meet customer demand as the queue reopens.
The attack behind the recovery
SpendNode has tracked this incident since it broke. Earlier reporting established that investigators traced the breach to a single EIP-7702 account authorization, that the FBI attributed the operation to North Korea's TraderTraitor group, and that roughly $38 million of the proceeds moved through the Relay protocol in about seven hours before being flagged.
Set against a $6 billion theft, recovering the bulk of the funds implies the attackers managed to launder only a small fraction before Binance and its partners froze and clawed back the rest. That is the pattern analysis points to, rather than a figure Binance has itemized publicly. The gap between the amount moved into laundering channels and the amount recovered is the number to watch as the exchange publishes a fuller post-mortem.
The market held its ground
Crypto prices did not buckle on the news. As of November 1, 2026, Bitcoin traded near $77,708, up 0.8% on the day, while Ether sat around $2,266, up 1.2%, according to CoinMarketCap data. Both remain down on the week, with Bitcoin off about 3.8% over seven days and the Fear and Greed Index reading 35, in Fear territory.
The muted reaction fits the recovery narrative. Markets tend to price the realized loss, not the gross attempt. With the bulk of the funds back and withdrawals reopening, traders appear to be treating the episode as contained rather than as a run on the largest exchange.
When the exchange holds the keys
The episode is a reminder of what a custodial balance actually is. Funds on an exchange are an IOU, redeemable only when the platform lets you withdraw. For the window between the attack and the phased restart, Binance customers held claims they could not act on, whatever their account screens showed.
That gap is the core tradeoff of custodial convenience, and it is why some users route everyday money through cards that spend from your own wallet rather than an exchange balance. It is also worth watching how Binance's own card and payment rails handle the restart, since those products settle against the same balances that were frozen. A withdrawal pause and a spending pause are the same event from the user's side.
Overview
Binance will resume withdrawals in phases on Sunday after recovering the bulk of more than $6 billion that attackers tried to steal, an incident Reuters and Bloomberg call the largest cyber theft on record. The speed of the recovery and the flat market reaction both point to a contained event, while the phased restart signals the exchange is still proceeding carefully. The practical lesson predates this hack: a balance you cannot withdraw on demand is a claim, not cash.
