Binance Outflows After the Hack: Why $3.6B, $3.7B and $5.8B Are All Correct

Binance reopened withdrawals at 06:00 UTC on Sunday, November 1, and within hours three different Binance outflows figures were circulating: $3.64 billion, $3.74 billion and $5.8 billion. None of them is wrong. They measure different windows and different sets of wallets, and a trader who reads them as one number will misjudge how much capital actually left the exchange after the $6.3 billion October 29 hack.

Three Binance Outflows Numbers, Three Methods

The smallest figure comes from Binance itself. Between 06:00 and 15:30 UTC on November 1, the exchange reported $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of $3.64 billion, according to BigGo Finance. Binance framed that as about 2.1% of roughly $171 billion in reported assets.

The middle figure is DefiLlama's. TheStreet reported about $3.74 billion of net outflows from Binance-linked wallets over 24 hours as of 10:40 a.m. ET Sunday, with about $131.36 billion still tracked on the exchange. The same tracker showed $10.41 billion of net outflows over seven days, a window that includes the hack itself and the withdrawal pause.

The largest figure is also DefiLlama, read later in the day. Crypto Breaking and the KuCoin daily market report cite a rolling 24-hour net outflow that briefly reached $5.8 billion. Same tracker, a later window, and more of the reopening rush inside it. BigGo Finance points out directly that the Binance and DefiLlama numbers cover different windows and are not comparable.

Why DefiLlama and Binance Disagree on Net Flows

DefiLlama sees wallets, not customers. Per TheStreet, it tracks the wallets Binance discloses through its proof of reserves system plus wallets backing Binance-pegged tokens, and it cannot see Binance's internal customer ledger. Any movement from a disclosed wallet to one that is not yet disclosed prints as an outflow.

Binance has argued exactly that. Co-CEO Yi He said the tracker likely counted new hot wallet addresses as outflows, according to TheStreet, although Binance has not published its own figure for internal transfers. The same report separates three things that no public dataset currently gives in one place: gross withdrawals, net wallet changes, and confirmed customer withdrawals.

Then there is the denominator. Binance's 2.1% ratio divides by its own $171 billion. TheStreet's 2.8% divides by DefiLlama's $131 billion of tracked assets. Brad Feld notes that CNBC had reported $145 billion the previous week. Three asset bases for one exchange is a reminder that "percent of reserves" headlines are only as good as the number underneath.

The Asset Mix Matters More Than the Total

For perp traders, composition beats size. Early data showed USDT as the largest source of withdrawals, followed by USDC and then Bitcoin, according to Crypto Breaking and BigGo Finance. Stablecoins are the margin currency of USDT-margined perpetuals, so a stablecoin-led outflow is collateral leaving the venue, not just coins moving to cold storage.

That does not mean the money left crypto derivatives. TheStreet found one tagged move, a 2,000 BTC transfer worth about $156 million to an unlabeled wallet at 1:28 a.m. ET Sunday, and stressed that an unknown wallet does not prove a customer withdrawal. None of the reports reviewed for this piece published a destination breakdown. Claims that the outflow went to a specific DEX or rival exchange are, for now, not supported by public data.

The hack week itself already showed how easy it is to draw the wrong arrow. A 24/7 Wall St. analysis on October 30 concluded that HYPE's volume jump lined up with the ICE announcement while Binance withdrawals were still paused, so it could not have been Binance users moving funds to Hyperliquid.

What Binance Futures Positioning Looked Like Into the Reopening

Positioning on Binance was lopsided going into Sunday. QuantM Intel data cited by Coin Turk put about 73.4% of Binance futures accounts long, while Binance's ETH perpetual funded at -0.011% per eight hours. CoinGlass's OI-weighted BTC funding in the same report was +0.0104%.

A majority of accounts long while ETH funding is negative is a split worth tracking. Account counts measure people, funding measures size. When the two disagree, the side paying funding is usually the one with the bigger book, and here that side was short ETH.

The liquidation picture had already cooled. The same Coin Turk report put 24-hour liquidations at about $187.87 million, with longs at $143.91 million and Binance carrying 51.5% of the tracked volume. That is a fraction of the roughly $1.53 billion liquidated when Bitcoin briefly fell below $77,000 after the hack, per BigGo Finance.

The Signal to Watch: Tuesday's Proof of Reserves

The next hard data point is the zero-knowledge proof of reserves. Binance said it would be ready by Tuesday, November 3 UTC, because generating it takes 40 to 50 hours of computation, according to Brad Feld's update. An October 31 snapshot showed ten major assets fully backed, but it predates Sunday's withdrawals, per BigGo Finance. The proof is designed to let each customer confirm their balance is included in what Binance owes.

Practical reads for the next 48 hours:

• If stablecoin balances on Binance keep falling after the proof publishes, that is a second leg driven by trust, not by the reopening backlog.
• Compare open interest across venues instead of reading Binance OI alone. If Binance OI shrinks while total OI holds, positions are migrating rather than closing.
• Treat single-wallet transfers as noise until they are labeled. The 2,000 BTC move is the example.

Exchange-flow trackers are lagging and wallet-based. The tape is faster. On Buildix, the screener lists 170+ Hyperliquid pairs with open interest, funding and an orderflow signal column, so if size really does migrate onto Hyperliquid books it shows up as rising OI and a shift in funding long before any monthly volume report confirms it.

Binance itself described flows as "stabilising" over the weekend, per Feld. Whether that holds is a question the proof answers on Tuesday, and the stablecoin line answers in the days after.