Binance or DefiLlama? How to Read Two Outflow Numbers From One Withdrawal Restart
Bottom line first: the two figures arguing in public after the incident at Binance are not two versions of the same event. One is an internal ledger snapshot of what customers moved in and out; the other is an on-chain estimate of value leaving wallet addresses a tracker recognises as the exchange's. Binance says its net outflow reading reflects client withdrawals and deposits as of 15:30 GMT. The analytics dashboard from DefiLlama shows a larger number, $4.36 billion, because the chain counts transfers the platform does not treat as customer movements at all. Once you fix the boundary and the clock, the "who is lying" framing disappears and a normal measurement problem appears.
That distinction is worth learning, because a second data point arrives every time a large venue suspends withdrawals and then switches them back on in stages.
What happened, in the order it happened
Online service returned with withdrawals reopened in phases instead of all at once. The first phase covers 15 tokens, among them Bitcoin, Ethereum, tokens linked to certain USDC and USDT stablecoins, and Dogecoin. The stated logic was triage by demand: the order in which coins were unlocked followed user needs observed over the preceding week, and each asset comes back only when its own chain, node sync and risk checks are judged ready.
Two elements of the platform's own recovery notes shape how you should read the numbers. First, a proof-of-reserves snapshot was taken around the restart, and users were pointed to a self-service verification page. Second, the company said the bulk of affected assets had been replaced and that roughly $3 billion had been frozen on-chain, with no evidence so far of wallet private key leakage. Both claims come from the company itself, so they are inputs to a verification process rather than the end of one.
Same incident, two ledgers
| Dimension | What Binance states | What the DefiLlama dashboard shows |
|---|---|---|
| Object measured | Customer withdrawals minus customer deposits | Value flowing out of labelled exchange wallets on-chain |
| Cut-off | Snapshot taken as of 15:30 GMT | Rolling series, restated as address labels catch up |
| Internal treasury moves | Excluded by definition — not customer activity | Can be counted as outflow until new hot wallets are identified |
| Headline figure in this episode | Points readers to its most recent update on X | $4.36 billion |
| Who controls the data | The company, self-reported | Third party, reconstructed from public chain data |
| Main failure mode | Single source, no independent tie-out | Label coverage gaps and timing lag |
| Best use | Reconciling what customers actually did | Early stress signal and cross-exchange comparison |
Notice that the disagreement sits almost entirely in one row: internal treasury moves. Everything else is standard bookkeeping noise — different clocks, different scopes, different incentives to round.
The hot-wallet blind spot explains the gap
DefiLlama's centralised-exchange transparency pages are unusually candid about method: flows are inferred from tracked hot wallets, and only part of an exchange's cold storage is followed. That makes labels the weak point. When a platform under incident pressure sweeps balances into freshly created hot wallets, the new addresses are unknown to the tracker at the exact moment of the transfer, so an internal reshuffle is temporarily booked as money leaving the building.
A Binance spokesperson put it directly: "This figure does not include the fund flows we have already moved into our own new hot wallets, so it is not accurate. Our latest update on X is closest to the actual situation (though deposit and withdrawal changes that occurred after that data was published are not included)."
The reusable lesson: when a third-party dashboard and a company statement differ by 10–20%, test whether the gap is roughly the size of a custody reshuffle before concluding that either side is fabricating. Methodology disputes are usually resolved by publishing an address list, not by shouting louder.
Phased restart, full restart, or freeze: three ways to reopen
| Reopening mode | What it protects | What it costs users | Signal it sends |
|---|---|---|---|
| All at once, every asset | Speed and optics | Risk of a queue jam and of reactivating an unverified chain | Confidence, or theatrics if checks are incomplete |
| By stages, token by token (the route chosen here) | Operational control, per-chain validation, liquidity headroom | Long-tail holders wait; a two-class experience emerges | "We are testing as we go" — cautious, but invites speculation |
| Freeze until the audit is finished | Investigation integrity | Runs straight into a bank-run dynamic | Weakest option for trust in a liquid market |
Reading the first batch of assets tells you how the operator thinks. Bitcoin and Ethereum carry the most withdrawal demand; USDC- and USDT-linked tokens relieve the pressure that would otherwise push users toward off-ramps; a high-volume asset such as Dogecoin rounds out the demand curve. Leaving illiquid or lightly used tokens for a later phase is not punishment — it is where a platform has least confidence that everything downstream is verified.
Put the outflow in proportion
Absolute amounts invite panic; ratios invite judgement. In its update on X, the exchange said that during the first day of reopened withdrawals roughly $4.649 billion went out and about $1.01 billion came back in, a net outflow close to $3.64 billion — around 2.10% of the $171 billion asset base reflected in its 28 October proof-of-reserves data, as carried by market-data wires. The pattern that followed is the important part: an initial spike, then stabilisation, with deposits staying elevated.
Scale context helps too. TRM Labs' 2026 research on hacking economics finds that about 75% of stolen funds come from only 4% of incidents. A single event of this size dominates any annual dataset, which is why week-over-week exchange flow comparisons look strange for a while after an attack and should be discounted.
Seven checks before you repeat an outflow number
- Name the boundary first: customer flows, or on-chain wallet flows? The words "outflow" and "net flow" are not interchangeable.
- Pin the timestamp and time zone. A snapshot cut at 15:30 GMT is not comparable with an all-day aggregate.
- Ask what is excluded — internal wallet migrations, sub-account transfers, locked or frozen balances.
- Convert the amount into a percentage of the disclosed asset base before reacting to it.
- Check whether withdrawals actually complete, not merely whether the button is enabled.
- Look for a verification artefact you can use yourself, such as a proof-of-reserves snapshot with a personal Merkle leaf and Record ID.
- Watch whether the tracker's figure gets restated later; dashboards move when labels catch up.
Common misconceptions
- The bigger dashboard number proves the company is hiding the truth. Usually it proves the tracker cannot see freshly created wallets yet.
- Withdrawals are open, so the incident is over. A staged restart means only the unlocked assets have cleared internal checks.
- Proof of reserves is the same as an audit. A snapshot shows assets covering listed liabilities at one instant; it does not price the whole balance sheet or contingent obligations.
- Net outflow equals insolvency risk. It measures behaviour, not solvency — the ratio and the trend matter more than the headline dollar figure.
- Anyone contacting you about recovery is from support. Impersonation campaigns reliably follow high-profile incidents, as the Australian Federal Police and the FBI have warned in separate advisories.
FAQ
Which of the two figures should I cite?
Cite the one whose boundary matches your question, and always publish the cut-off. "Customer withdrawals minus deposits as of 15:30 GMT" is a defensible sentence; "over $4.36 billion left the exchange" is not, unless you add "according to on-chain labels".
Why does the company keep pointing at its latest update on X?
Because the statement is time-boxed: anything that happened after the snapshot is outside the figure it published. It is an honesty convention, though a weak one for readers who arrive hours later.
Should I withdraw just because the gates opened?
Decide on the facts you can verify: does your asset sit in an unlocked phase, do withdrawals complete, is the disclosed outflow a small share of the asset base, and has a reserves snapshot been published? A panic withdrawal converts a liquidity event into a personal cost — fees, slippage, and a destination address you chose in a hurry.
Can I check the reserves claim myself?
Partly. On a proof-of-reserves hub, a logged-in user can retrieve their own Merkle leaf and Record ID and compare it against the published snapshot, so at minimum you can confirm your balance was included.
Does a 15-token first phase mean funds are short?
Not necessarily. Sequencing by asset is standard incident response: it caps concurrency while each chain is exercised. It does, however, mean holders of not-yet-unlocked tokens should treat the restart as incomplete.
What to do, situation by situation
Small, long-term balance
Nothing in a staged restart changes your position. Watch two signals only: whether later phases keep arriving on schedule, and whether the next reserves snapshot repeats the coverage of the last one.
Active trader
Your real exposure is operational: a coin that is tradeable but not withdrawable turns a hedge into an unhedgeable position. Resize until the asset you need is confirmed in an open phase.
You hold tokens still locked
You are in the weakest group, because the queue is priced by aggregate demand rather than by your holding period. Set a reminder for each announced phase rather than refreshing the withdrawal page, and avoid third-party "priority withdrawal" services entirely.
You are weighing self-custody after this
Trade counterparty risk for key risk — that is the whole deal. For most readers the balanced answer is split custody, not all-or-nothing: keep an operating balance on a venue whose reserves you have actually checked, and move long-term holdings to hardware control you can recover from a seed-phrase test.
The takeaway for a general reader: an exchange incident produces two kinds of numbers — the ones a company can prove from its own ledger and the ones a tracker infers from public chains. Neither is disqualifying, and neither is complete. Your job is not to pick a side but to demand the boundary, the timestamp and the denominator before letting a headline make you act.