Binance resumed withdrawals on Sunday after covering most of the $6.3 billion stolen in the October 29 attack, Reuters reported, and by 15:30 UTC put its net outflows at roughly $3.6 billion. Competing tallies from on-chain data providers, however, show higher figures, and the gap comes down to measurement windows, wallet coverage and how newly created exchange addresses get labeled.

Binance Counted 9.5 Hours, DefiLlama Counted 24

Binance said it processed about $4.65 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on Sunday, according to The Block. Deposits offset roughly a fifth of what left, which is why the net figure sits near $3.6 billion rather than at the gross total. Those hours followed a freeze that had been in place since October 29.

The exchange set the net figure against $171 billion in assets under management drawn from its October 28 proof-of-reserves data and put the outflow at 2.1%. That denominator predates the hack, so the ratio compares Sunday's exit with Binance's holdings before the theft, not with what it holds now.

Binance also said withdrawal volumes were stabilizing after the opening spike while deposits stayed substantial. It published no hourly breakdown, so the shape of that decline cannot be verified from outside the exchange.

The competing readings stand as follows:

• Binance, self-reported: roughly $3.6 billion net, 06:00–15:30 UTC, Nov 1
• DefiLlama, via The Block: roughly $4.05 billion net, 24 hours to 16:37 UTC, Nov 1
• DefiLlama, via Reuters: roughly $4.4 billion, window not specified

These figures do not measure the same thing. DefiLlama's 24-hour window opens on Saturday afternoon, more than 13 hours before Binance processed its first withdrawal, at a time when customers had no way to move funds off the exchange. Any balance drop recorded in those hours could not have been a customer exit.

Coverage differs as well. DefiLlama tracks about $131 billion in wallets it attributes to Binance, well short of the $171 billion the exchange reports, meaning the two are counting flows across different sets of addresses.

A New Hot Wallet Looks Like Money Leaving

After the attackers drained its hot wallets, Binance began processing withdrawals from newly generated wallets and added them to its proof-of-reserves list, The Block reported. Until a tracker tags a new address as belonging to Binance, funds the exchange moves into it register as an outflow. CryptoQuant's methodology guide flags the same risk: unidentified exchange addresses can make an internal transfer look like an external withdrawal.

That is the basis of Binance's objection to the higher DefiLlama reading, which the exchange said did not fully account for deposits into the new hot wallet. No tracker has published a reconciliation yet. Until the new addresses are labeled and the windows are matched, that explanation rests on Binance's word.

The same labeling problem clouds the attack-day data. CryptoQuant recorded about 28,000 BTC and roughly 2.9 billion ERC-20 USDT leaving Binance-tagged wallets on October 29. Those totals mix stolen funds, emergency transfers and any customer withdrawals processed before the freeze, and the USDT series covers only the token's Ethereum version. The USDT figure carries a second complication: part of it is stolen stablecoin that issuers could, in principle, freeze. Coindoo's breakdown of how the hacker outmaneuvered those freezes shows how the attacker kept the funds moving anyway.

Where the Money Showed Up

Only a small share of Sunday's outflow surfaced at rival venues. Over the same 24 hours, the ten next-largest exchanges in DefiLlama's data recorded about $368 million in combined net inflows, led by OKX at nearly $317 million, while Bitfinex and Gate posted net outflows. DefiLlama does not cover Coinbase or Kraken, but CoinGlass data cited by The Block showed their bitcoin balances rising by about 984 BTC and 1,422 BTC respectively, while Binance's fell by about 19,289 BTC.

Most of the money therefore went to addresses these dashboards do not label. Those could be self-custody wallets, smaller exchanges or Binance addresses that have not yet been tagged, and on-chain data alone cannot distinguish among them.

What Customers Can Actually Withdraw

Binance ordered the first phase of restorations by the previous week's withdrawal demand, which is why major coins and the busiest stablecoin networks returned first. In its November 1 recovery update, the exchange said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed. The roughly 5% of stolen value it had not yet replaced sits in less liquid tokens outside that group, which it is still buying through market and OTC channels.

Withdrawal status on Sunday afternoon (UTC):

• 12:36 – All 15 phase-one networks reopened
• 16:22 – Status page showed 531 of 552 coins suspended; 14 partly restored, including BTC and ETH
• Still in testing – Cardano, Chainlink, Hyperliquid, Litecoin, NEAR and other networks

For anyone holding a coin that is still suspended, Sunday's billions say nothing about their own balance. Binance's network status page lists availability for each asset and network pair.

Replacing stolen value with company money is also separate from recovering the stolen coins themselves. Binance says it is working with law enforcement and industry partners to trace and freeze them, but its November 1 update did not say how much has been frozen so far.

Reserve Data Still Predates Sunday

Both reserve references in circulation sit before the surge. The 2.1% ratio rests on October 28 data. Binance said its next proof-of-reserves report, computed with zero-knowledge proofs and expected on Monday, uses an October 31 snapshot. That report can show what backed customer balances on Saturday, not what remained after Sunday's payouts. The PCAOB's investor advocate has also cautioned that such reports are not audits and reveal little about an entity's wider finances.

Three markers will show whether Sunday was a backlog clearing or the start of a longer exit. The first is whether the suspended coins come back online. The second is whether DefiLlama's figures move closer to Binance's once the new wallets are labeled. The third is the first reserve snapshot dated after November 1.

This article was originally published by Coindoo.