Key Takeaways
- What it is: Two series, not one. Gross value arriving at addresses attributed to an exchange, and gross value leaving them.
- How it is built: Each transfer is classified by testing both endpoints against the exchange's label set. One endpoint inside is a flow; both inside is internal and should be discarded.
- Core expression: Gross inflow sums transfers whose sender sits outside the label set and whose recipient sits inside it. Gross outflow reverses the test.
- Best use: The two gross series read separately. Deposits arrive as many small transfers and withdrawals leave in a few batches, and subtraction throws that distinction away.
- Main limitation: An exchange moving coins between its own wallets dwarfs customer activity, and one unlabeled cold wallet turns routine plumbing into a phantom flow.
- Practical rule: State the net as a share of gross turnover. A net worth a few percent of the numbers that produced it sits inside their classification error.
Who This Guide Is For
Read this if a deposit or withdrawal spike has ever looked like evidence of intent. More often it is an exchange rearranging its own custody, and this page separates the two from the transfer record.
Three pages divide the subject. Exchange reserves owns the stock and the label-set construction behind it. Exchange netflow owns the netted number. This page owns the two gross series and the internal-transfer contamination that distorts both.
Educational content. Not individualized financial advice.
What Does Exchange Inflows and Outflows Measure?
It measures value crossing a line a data vendor drew rather than one the blockchain provides. Every transfer falls into one of four cells depending on which side its two endpoints sit on, and only two are flows.
| Sender | Recipient | Classification | In the series? |
|---|---|---|---|
| Outside the label set | Inside | Inflow | Yes |
| Inside | Outside | Outflow | Yes |
| Inside | Inside | Internal | No, discard |
| Outside | Outside | Unrelated | Never observed |
The third row decides whether the metric works. A large exchange moves coins among its own addresses constantly: consolidating deposit balances, refilling a hot wallet, pushing an accumulated balance into cold storage, rotating keys. Each produces an exchange-sized transfer with nobody outside the firm on either end.
Plain-language definition
Inflow is how much arrived at wallets somebody believes belong to an exchange. Outflow is how much left. Both are only as good as the belief.
Technical definition
For a label set E and window W, gross inflow sums transferred value over transfers whose sender is not in E and whose recipient is. Gross outflow swaps the conditions. The series is a function of E, a private dataset that is incomplete by construction and revised continuously.
How Is Exchange Inflows and Outflows Constructed?
Construction has two halves: reconstructing the exchange's internal address architecture, then deciding which transfers across it count. Errors in the first propagate into the second.
The four address tiers that generate the transfers
- Deposit addresses. One per customer per asset, numbering in the millions. Each receives a single payment and is emptied.
- Consolidation wallets. The exchange periodically sweeps deposit addresses into a few collection wallets. One sweep can drain thousands of addresses.
- Hot wallets. Online, holding only enough to fund near-term withdrawals, paying out in batches that serve many customers per transaction.
- Warm and cold storage. Holding the bulk of the balance, receiving coins after sweeps accumulate and returning them when the hot wallet runs low.
Only two of those transactions have a customer on the far side: the payment into a deposit address, and the payout from a hot wallet. Everything else is plumbing.
How the address set is assembled
Sweep behavior is the workhorse technique. A researcher funds a deposit address, waits for the sweep, and records the destination. Every other address ever swept into that wallet belongs to the same exchange, so one deposit yields thousands of labels. Published hot-wallet addresses and batching signatures fill in the rest. Exchange reserves covers label construction in full, and the address labeling and entity clustering guide covers the general problem.
Why a newly discovered cluster rewrites history
Classification is a membership test, so adding one address reclassifies every transfer that ever touched it. A cold wallet discovered today was an outsider until yesterday: moves into it scored as outflows, top-ups out of it as inflows. Once it joins the set, both become internal and vanish.
Whether they vanish from history depends on the vendor's revision policy, worth checking against the Coin Metrics API v4 documentation or its equivalent. Backfilling produces a chart today that disagrees with last month's from identical chain data. Applying the correction only forward leaves a step at the discovery date that reads as a regime change. Without dated retrievals, a reader cannot tell which happened.
Formula and Measurement Logic
Gross inflow(W) = Σ value(t) for transfers t in W with sender(t) ∉ E and recipient(t) ∈ E
Gross outflow(W) = Σ value(t) for transfers t in W with sender(t) ∈ E and recipient(t) ∉ E
Netflow(W) = gross inflow(W) − gross outflow(W)
The arithmetic is a filter and a sum, so everything of consequence sits in the filter.
| Transaction | Correct treatment | Effect of a missing label |
|---|---|---|
| Customer pays into a deposit address | Inflow | Invisible if the deposit address is unlabeled |
| Sweep of deposit addresses into a consolidation wallet | Internal, discard | Becomes an inflow, batched and hours late |
| Consolidation wallet to cold storage | Internal, discard | Becomes an outflow if cold storage is unlabeled |
| Cold storage refilling the hot wallet | Internal, discard | Becomes an inflow if cold storage is unlabeled |
| Hot wallet pays a withdrawal batch | Outflow | Correct, but many customers collapse into one transaction |
| Change output returning to the exchange | Internal, discard | Becomes an outflow if the change address is unlabeled |
Why the error concentrates on the net
Subtraction adds error rather than cancelling it, so the net inherits the classification error of both gross series while keeping only the small difference between them. A net worth a few percent of turnover is a residual, not a measurement.
How Should Exchange Inflows and Outflows Be Interpreted?
Read the two gross series side by side and treat the net as derived. The processes generating them have different shapes, and that difference is itself diagnostic.
The two sides have different statistical shapes
Inflow is count-driven, assembled from many small customer payments to distinct addresses, so its daily total moves because the number of depositors moved. Outflow is size-driven, because withdrawals are batched: a day of retail activity may be a few dozen transactions each paying hundreds of recipients, and the total moves because a few large ones happened.
So divide each series by its own transfer count. When mean inflow size jumps by an order of magnitude while inflow transfer count stays flat, no wave of depositors arrived. One large transfer did, and a large transfer landing at an exchange is at least as likely to be plumbing or an institutional settlement leg as a seller.
What a deposit does not tell you
Custody transfers happen for reasons with no directional content. Market makers rebalance inventory between venues in both directions every day, and at a large exchange that traffic is a substantial share of transfer count by design. Collateral postings for derivatives positions arrive as deposits and may never be sold. Neither is distinguishable from a retail deposit by the transfer alone.
Step-by-Step Workflow
- Retrieve gross inflow and gross outflow separately.
- Retrieve transfer counts alongside values, then compute mean transfer size for each side.
- Flag any individual transfer worth more than a tenth of that side's daily total.
- Trace each flagged counterparty before treating the transfer as a flow.
- Decompose by venue, since one exchange's custody reorganization routinely drives an aggregate move.
- Establish the provider's revision policy, and store dated retrievals if it backfills.
- Quote the net with its share of gross turnover attached.
- Describe the result as movement of custody, never as intent to trade.
Worked Hypothetical Scenario
This example is hypothetical and every figure is invented for the arithmetic. One exchange, one day, four transfers touching its known addresses, amounts in native units.
| Transfer | From | To | Amount |
|---|---|---|---|
| T1 | About 3,000 customer addresses | Deposit addresses | 4,200 |
| T2 | Deposit addresses | Hot wallet, one sweep | 4,050 |
| T3 | Hot wallet | Cold wallet W | 12,000 |
| T4 | Hot wallet | About 2,500 external addresses | 3,800 |
Nothing there is unusual. Now compute the published series under three states of label coverage.
| Label-set coverage | Gross inflow | Gross outflow | Netflow |
|---|---|---|---|
| Deposit and hot known, cold wallet W unknown | 4,200 | 15,800 | −11,600 |
| Deposit, hot, and cold wallet W all known | 4,200 | 3,800 | +400 |
| Hot and cold known, deposit addresses unknown | 4,050 | 3,800 | +250 |
In row one, T3 scores as an outflow because its destination is unrecognized, so gross outflow is 12,000 plus 3,800 and one transaction is 75.9 percent of it. The net reads as 11,600 units of withdrawal.
In row two, W has been discovered. T3 becomes internal, gross outflow falls to 3,800, and the net flips to a positive 400: the same day now reports a net 29 times smaller and pointing the other way. No coin moved differently. A vendor updated a list.
Row three is the mirror image. With deposit addresses unrecognized, T1 is invisible because neither endpoint is in the set, and T2 is promoted to an inflow because it appears to arrive from outside. Inflow becomes 4,050 rather than 4,200, the missing 150 being deposits not yet swept at the day boundary, and it is timestamped at the sweep, arriving as one event instead of roughly 3,000.
Now judge the honest row on its own terms. Gross turnover is 8,000 and the net of 400 is 5 percent of it, so an error of 400 units, being 9.5 percent of inflow or 10.5 percent of outflow, erases the net entirely.
What Can Make the Interpretation Wrong?
- Internal transfers scored as flows. The central failure. Movement between an exchange's own wallets is exchange-sized and routine, and each unlabeled endpoint converts it into a phantom flow.
- A label set that is too generous. A market maker's address wrongly folded into the cluster turns that firm's real deposits and withdrawals into internal transfers, and they disappear from both series.
- Sweep timing shapes the inflow series. Where deposit addresses are unlabeled, the inflow clock is the sweep schedule, giving the series an intraday and weekday pattern with no behavioral meaning.
- Batching destroys withdrawal counts. Hundreds of customer withdrawals arrive as one transaction, so outflow transfer counts understate withdrawal events badly.
- Trading inside the exchange is invisible. Selling one asset for another on the order book produces no chain activity, so a flat flow series is consistent with enormous trading.
- Aggregation across venues. A sector-wide chart is usually one venue's plumbing plus noise from everyone else.
- Fixed thresholds carried across years. Treating a 10,000 unit inflow day as significant ages badly as venues, supply, and market-maker inventory grow.
Cross-Network and Provider Comparison
The ledger model changes what a single transfer is, and sweeps and withdrawal batches are exactly where the two models diverge most.
On a UTXO chain a sweep can be one transaction consuming several thousand inputs, and a withdrawal batch one transaction creating several hundred outputs, so whether a provider counts one transfer or several thousand changes transfer counts by orders of magnitude on the days that matter. Every spend also produces a change output at a fresh address the exchange controls but nobody has labeled, as described in the Bitcoin Developer Guide: Transactions.
On an account chain a native transfer is a transaction field while a token transfer is a contract event, so a token flow series reads logs and must decide how to treat contract intermediaries. Deposits routed through a smart-contract wallet or a settlement contract show that contract as the sender, which defeats any attempt to characterize the depositor. Our UTXO versus account model guide covers the difference.
Providers also differ on whether values are native units or converted at the transfer's timestamp or a daily close. On a day with a large price move, the two series can point in opposite directions.
Advanced Analytical Methods
Round-trip detection
The cleanest test for an unlabeled internal address is behavioral. An outflow destination that receives from the hot wallet, holds without dispersing, and later sends funds back toward the same cluster is the exchange's own storage, and the transfer should be reclassified.
Transfer-size distribution instead of totals
The distribution of individual transfer sizes exposes whether a day was driven by breadth or by one event. A total cannot distinguish 4,000 depositors from one 4,000 unit transfer, and that distinction is the entire question.
Counterparty-type attribution on the outflow side
Classify what received each outflow: another exchange, a bridge, a staking contract, or a fresh address with no history. Exchange-to-exchange transfers are a large share of gross outflow at major venues and represent inventory moving between trading locations rather than accumulation.
Rebuilding the series from raw transfers
Applying your own classification rule is the only way to know it with certainty, and it yields the sensitivity that matters most: how far the net moves when one suspected internal address is added or removed.
Practical Checklist
- I have both gross series, not only the net.
- I have transfer counts and mean transfer size for each side.
- I identified the largest transfers and checked their counterparties.
- I tested whether large outflow destinations later return funds to the same cluster.
- I decomposed by venue rather than reading an aggregate.
- I know the provider's revision policy and stored a dated retrieval.
- I expressed the net as a share of gross turnover.
- I described the result as custody movement rather than trading intent.
Frequently Asked Questions
What is an internal transfer and why does it contaminate the series?
An internal transfer moves coins between two addresses the same exchange controls, such as sweeping deposits into a collection wallet or refilling a hot wallet from cold storage. It has no customer on either side and should be discarded. It contaminates the series because classification requires both endpoints to be recognized, so one unlabeled address turns a purely internal move into a large recorded flow.
Why is the gross pair better than the netflow number?
The net is the difference between two large numbers that usually sit close together, so it inherits the classification error of both while keeping only a small fraction of their magnitude. Knowing a net of 400 came from an inflow of 4,200 and an outflow of 3,800 tells you at once that a 10 percent error on either side would erase it.
Does a large deposit mean someone is about to sell?
Not reliably. Market makers move inventory between venues in both directions every day, and at a large exchange that rebalancing is a substantial share of transfer count. Collateral postings for derivatives positions also arrive as deposits and may never be sold. None of these is distinguishable from a retail deposit by the transfer alone.
What does an unlabeled change output do to the outflow series?
On a UTXO chain, spending from an address returns the unspent remainder to a fresh change address the exchange controls but a labeler may not yet recognize. That change output is then scored as an outflow, so part of the exchange's own retained balance is recorded as having left. The distortion grows with how often the exchange spends, so it is worst at the busiest venues.
How does a per-user deposit address model differ from a shared address model?
Some exchanges assign each customer a unique deposit address and later sweep the balances into central wallets. Others credit deposits sent to one shared address with an attached identifier. The first produces a large and constantly growing address set that a labelling process must keep up with, plus a stream of internal sweep transactions that look like flows. The second concentrates deposits into a few well known addresses that are easy to label but gives no per-customer resolution. Coverage quality differs sharply between the two, and it differs by chain.
What happens to the series when an exchange rotates its wallets?
A rotation moves a large balance from a known address set to a new one that is not yet labelled. Until the new addresses are identified, the movement reads as an enormous outflow followed by an apparent shrinking of the exchange's holdings, none of which involved a customer. Providers catch these events with varying speed, which is why an unexplained step change in a flow series is worth checking against the reserve balance before it is interpreted. A real outflow reduces the total; a rotation moves it.
Do stablecoin inflows and coin inflows carry the same meaning?
They point in opposite directions under the usual reading. A coin arriving at an exchange is often framed as potential sell-side supply, while a stablecoin arriving is framed as potential buying power. Both readings are weak on their own, since either asset may be arriving for market making, collateral, arbitrage or transfer to another venue. But mixing the two into a single flow number destroys even that weak signal, so the series should be kept separate by asset type rather than aggregated in currency terms.
How should flows be adjusted for an exchange's own staking and custody products?
They need separating, because coins moving into an exchange's staking contract or its custody arm are not arriving to be sold, yet they often move through the same address set. Where an exchange operates a staking service, large periodic movements between its trading wallets and staking infrastructure appear as flows with no trading intent behind them. Providers that identify these sub-entities separately produce cleaner series, and the difference between providers on this point is a common source of disagreement.
Should exchange flows be measured in coins or in currency terms?
In coins for the underlying analysis, with a currency conversion applied afterwards if needed. A series denominated in dollars mixes two things: how many units moved and what a unit was worth. During a sharp price move, the dollar series can rise while the coin count falls, which makes it impossible to say whether more coins arrived. Measuring in native units keeps the quantity clean, and the currency value can be shown alongside for scale rather than substituted for it.
References
These sources should be reviewed during editorial verification. They support data structures and methods, not the hypothetical conclusion. Provider formulas, chain rules, and APIs can change. Confirm current documentation before publication.
- Dune: Address Labels: how exchange address sets are tagged and maintained.
- Etherscan API Documentation: address and transfer lookups for tracing a flagged counterparty.
- Bitcoin Developer Guide: Transactions: multi-input sweeps, batched payouts, and change outputs.
- Ethereum.org: Transactions: account-model transaction fields, and token transfers as contract events.
- Coin Metrics API v4: frequencies and revision behavior, relevant to backfilled label corrections.
- Coin Metrics: Network Data Glossary: cross-network address and transfer definitions. Editorial review should confirm that every provider definition remains current on the publication date.