Binance Withdrawal Rush – Why the Numbers Don’t Match

Key Takeaways

• Binance reports $3.6 billion in net outflows.
• DefiLlama’s 24-hour window includes pre-reopening hours.
• Most coins remained suspended on Sunday afternoon.
• Next reserve report predates the withdrawal surge.

The exchange restarted withdrawals after covering most of the $6.3 billion stolen in the October 29 attack, Reuters reported, and put its net outflows at roughly $3.6 billion by 15:30 UTC.

Binance counted 9.5 hours, DefiLlama counted 24

Binance said it processed about $4.65 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on Sunday, according to The Block. Deposits offset roughly a fifth of what left, which is why the net figure sits near $3.6 billion rather than at the gross total. Those hours followed a freeze that had been in place since October 29.

The exchange set the net figure against $171 billion in assets under management from its October 28 proof-of-reserves data and put the outflow at 2.1%. That denominator predates the hack, so the ratio compares Sunday’s exit with Binance’s holdings before the theft, not with what it holds now.

Binance also said withdrawal volumes were stabilising after the opening spike while deposits stayed substantial. It published no hourly breakdown, so the shape of that decline can’t be checked from outside the exchange.

Binance, self-reported

≈ $3.6B net

06:00–15:30 UTC, Nov 1

DefiLlama, via The Block

≈ $4.05B net

24 hours to 16:37 UTC, Nov 1

DefiLlama, via Reuters

≈ $4.4B

Window not specified

These figures don’t measure the same thing. DefiLlama’s 24-hour window opens on Saturday afternoon, more than 13 hours before Binance processed its first withdrawal, when customers had no way to move funds off the exchange. Any balance drop recorded in those hours could not have been a customer exit.

Coverage differs too. DefiLlama tracks about $131 billion in wallets it attributes to Binance, well short of the $171 billion the exchange reports, so the two are counting flows across different sets of addresses.

A new hot wallet looks like money leaving

After the attackers drained its hot wallets, Binance began processing withdrawals from newly generated wallets and added them to its proof-of-reserves list, The Block reported. Until a tracker tags a new address as Binance’s, funds the exchange moves into it register as an outflow. CryptoQuant’s methodology guide flags the same risk: unidentified exchange addresses can make an internal transfer look like an external withdrawal.

That is the basis of Binance’s objection to the higher DefiLlama reading, which it said did not fully account for deposits into the new hot wallet. No tracker has published a reconciliation yet. Until the new addresses are labelled and the windows are matched, the explanation rests on Binance’s word.

The same labelling problem clouds the attack-day data. CryptoQuant recorded about 28,000 BTC and roughly 2.9 billion ERC-20 USDT leaving Binance-tagged wallets on October 29.

Those totals mix stolen funds, emergency transfers and any customer withdrawals processed before the freeze, and the USDT series covers only the token’s Ethereum version. The USDT figure carries a second complication: part of it is stolen stablecoin that issuers could, in principle, freeze. Coindoo’s breakdown of how the hacker outmanoeuvred those freezes shows how the attacker kept those funds moving anyway.

Where the money showed up

Only a small share of Sunday’s outflow surfaced at rival venues. Over the same 24 hours, the ten next-largest exchanges in DefiLlama’s data recorded about $368 million in combined net inflows, led by OKX at nearly $317 million, while Bitfinex and Gate posted net outflows. DefiLlama doesn’t cover Coinbase or Kraken, but CoinGlass data cited by The Block showed their bitcoin balances rising by about 984 BTC and 1,422 BTC as Binance’s fell by about 19,289 BTC.

Most of the money therefore went to addresses these dashboards don’t label. Those could be self-custody wallets, smaller exchanges or Binance addresses that haven’t been tagged yet, and on-chain data alone can’t tell them apart.

What customers can actually withdraw

Binance ordered the first phase by the previous week’s withdrawal demand, which is why major coins and the busiest stablecoin networks returned first. In its November 1 recovery update, the exchange said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed. The roughly 5% of stolen value it had not yet replaced sits in less liquid tokens outside that group, which it is still buying through market and OTC channels.

Withdrawal status on Sunday afternoon (UTC)

12:36 – All 15 phase-one networks reopened

16:22 – Status page showed 531 of 552 coins suspended; 14 partly restored, including BTC and ETH

Still in testing – Cardano, Chainlink, Hyperliquid, Litecoin, NEAR and other networks

For anyone holding a coin that is still suspended, Sunday’s billions say nothing about their own balance. Binance’s network status page lists availability for each asset and network pair.

Replacing stolen value with company money is also separate from recovering the stolen coins themselves. Binance says it is working with law enforcement and industry partners to trace and freeze them, but its November 1 update did not say how much has been frozen so far.

Reserve data still predates Sunday

Both reserve references in circulation sit before the surge. The 2.1% ratio rests on October 28 data. Binance said its next proof-of-reserves report, computed with zero-knowledge proofs and expected on Monday, uses an October 31 snapshot. That report can show what backed customer balances on Saturday, not what remained after Sunday’s payouts. The PCAOB’s investor advocate has also cautioned that such reports are not audits and reveal little about an entity’s wider finances.

Three markers will show whether Sunday was a backlog clearing or the start of a longer exit. The first is whether the suspended coins come back online. The second is whether DefiLlama’s figures move closer to Binance’s once the new wallets are labelled. The third is the first reserve snapshot dated after November 1.