Crypto exchange inflows measure assets transferred into addresses attributed to exchanges; outflows measure assets transferred out. Netflow is inflow minus outflow within the same asset, period and address scope. These movements can reflect deposits, withdrawals, custody or wallet operations. They do not prove that someone bought or sold. Check address labels, internal transfers and coverage before interpreting a flow alert.
Define the boundary before reading the number
An exchange-flow chart starts with an attribution decision: which blockchain addresses belong inside its exchange set? The transactions are observable; the assignment of an address to an exchange requires additional evidence. A missing address can change how a genuine transfer is classified.
CryptoQuant's flow definitions distinguish the amount deposited, the amount withdrawn and their difference. A positive netflow means more units entered than left that defined scope. A negative netflow means the reverse. Neither sign tells you the gross activity: 320 units entering and 110 leaving have the same net result as 210 entering and none leaving.
Check whether the display reports token units, dollar value, transaction count or mean transfer size. These answer different questions. A dollar-valued balance can rise because the token price changed, even without a transfer. A large transfer count can coexist with a small transferred amount. Address counts introduce another distinction, explained in the active addresses versus users guide.
For the calculations below, an inflow crosses from outside a stated address set to inside it. An outflow crosses in the opposite direction. Transfers entirely within the set are excluded from both. This is an explicit teaching convention; check how your provider treats each component before reproducing its chart.
Reconcile seven transfers without inventing trades
The following ledger is hypothetical. It covers one complete UTC day for a fictional fixed-unit token, T, on one chain. All seven transfers are finalized. Fees are paid in another asset; there are no token burns, issuance, rebases or omitted T transfers.
Exchange A controls A-deposit, A-hot and A-cold. Their opening balances are 15 T, 250 T and 735 T, totaling 1,000 T. Exchange B controls B-hot, which starts with 300 T. U and V are external customers; W is an external institution. C is an independent custodian outside the covered exchange set.
Ownership and purposes are stipulated for the example. A production researcher could not establish them merely from these abbreviated sender and recipient names.
| Record | Transfer | Amount | Stipulated purpose |
|---|---|---|---|
| 1 | U to A-deposit | 120 T | Customer deposit |
| 2 | A-deposit to A-hot | 120 T | Internal deposit sweep |
| 3 | A-hot to A-cold | 80 T | Internal storage move |
| 4 | A-hot to V | 70 T | Customer withdrawal |
| 5 | A-cold to B-hot | 40 T | Transfer between covered exchanges |
| 6 | W to A-cold | 200 T | Institutional custody allocation |
| 7 | B-hot to C | 30 T | Transfer to the independent custodian |
For Exchange A, records 1 and 6 are inflows: 120 + 200 = 320 T. Records 4 and 5 are outflows: 70 + 40 = 110 T. Its netflow is therefore 320 − 110 = +210 T, and its closing balance is 1,000 + 210 = 1,210 T.
Records 2 and 3 move 200 T within A. They change where A holds tokens while leaving its combined balance unchanged. Counting every receipt at A's individual addresses would report 520 T received, including those internal moves. That is a different statistic from the 320 T crossing A's boundary. Glassnode documents a separate In-House Exchange Volume series for transfers between wallets of the same exchange.
The custody allocation contributes 200 T to A's measured inflow. The scenario explicitly supplies no trading order for it. Calling all 320 T “coins deposited to sell” would add an intention that the ledger does not contain.
Aggregating venues changes the gross flows
Exchange B receives 40 T from A and sends 30 T to C, leaving a 10 T net inflow and a 310 T closing balance. Now draw one boundary around both exchanges.
| Scope | Inflow | Outflow | Netflow | Closing balance |
|---|---|---|---|---|
| Exchange A | 320 T | 110 T | +210 T | 1,210 T |
| Exchange B | 40 T | 30 T | +10 T | 310 T |
| Combined boundary | 320 T | 100 T | +220 T | 1,520 T |
The 40 T transfer from A to B crosses each venue's individual boundary. It does not cross the combined boundary. Adding the individual gross numbers gives 360 T of inflows and 140 T of outflows; measuring only transfers between the combined set and outsiders gives 320 T and 100 T. Both calculations yield the same 220 T net change under these fixed labels.
This explains why summing venue charts need not reproduce a provider's aggregate gross-flow chart. Establish whether inter-exchange transfers are included, excluded or reported separately. Also check which venues are covered. A movement to an uncovered exchange crosses the observed set even though it may remain within the broader exchange industry.
Our combined opening balance was 1,300 T. The closing check is 1,300 + 320 − 100 = 1,520 T. This reconciliation verifies the fixture's accounting, without answering why the owners transferred anything.
A missing label can reverse the apparent direction
Keep the seven transactions unchanged, but suppose an early dataset recognizes only A-deposit and A-hot as Exchange A addresses. A-cold is unclassified. “Unclassified” means outside the known set; it does not prove independent ownership.
That incomplete set receives 120 T in record 1. It appears to send 80 T outside in record 3 and 70 T outside in record 4. Its measured netflow is 120 − 80 − 70 = −30 T. Record 6 is invisible to that set because neither endpoint is recognized as A.
After A-cold is attributed to A, record 3 becomes internal, record 5 becomes an A outflow, and record 6 becomes an A inflow. The complete set has the previously calculated positive 210 T netflow. No blockchain transaction changed, yet the sign reversed.
Check the balances under each version too. The incomplete set opens at 265 T and closes at 235 T, matching its 30 T decrease. The complete set opens at 1,000 T and closes at 1,210 T. The added cold address held 735 T at opening and 975 T at closing. Its 240 T increase explains the revision from −30 T to +210 T. Adding that label expands both snapshots; it does not mean 975 T arrived when the label was corrected.
CryptoQuant's exchange methodology warning specifically describes apparent outflows that later prove to be internal wallet changes. That documented failure case supports investigating a surprising transfer. It does not authorize labeling any inconvenient outflow as internal without evidence.
Separate custody, balances and execution
Exchange control and trading availability are separate questions. A provider may attribute custody infrastructure to an exchange operator, or distinguish it from trading wallets. You need its actual classification. Glassnode's exchange-metrics methodology discusses institutional custody, changing wallet arrangements and alternative uses of transferred funds, including collateral.
In the fixture, the institution's 200 T remains a custody allocation because the scenario supplies that purpose. In real data, leave purpose unknown when the evidence does not establish it. The same discipline applies to withdrawals: an address outside the exchange set is not automatically a long-term holder or a person taking self-custody.
To establish an executed trade, seek an execution record with instrument, side, quantity, time and price. A transfer record lacks those fields. An exchange's public trade feed can describe market activity without linking a particular deposit to a particular sale.
Nor does an attributed token balance establish solvency. Glassnode's transparency notice separates its on-chain exchange metrics from spot and futures trading volume, and states that its balance data do not include obligations and liabilities. The 1,210 T balance in our example cannot answer whether A can meet all claims against it.
Match adjacent questions to the evidence they need. A transfer into a protocol does not identify the amount retained as income; use the protocol fees versus revenue framework to trace that allocation. If an outflow is actually a staking deposit, the staking ratio and liquid supply guide explains why the staked amount alone does not settle how transferable the resulting claims are.
Use a worksheet before escalating a flow alert
Record these fields for the observation you are investigating. Leave unknowns visible instead of replacing them with an intention.
| Check | Evidence to save | Failure it helps detect |
|---|---|---|
| Asset and units | Chain, contract or native asset, token units and valuation rule | Combining different assets or price effects |
| Boundary | Provider, metric ID, covered venues and custody treatment | Comparing different address sets |
| Transfer classification | Hashes, endpoints, label evidence and internal/inter-exchange rules | Calling a wallet reshuffle a withdrawal |
| Window | Start, end, timezone and indexed block range | Comparing partial and complete periods |
| Reconciliation | Matching opening balance, inflow, outflow and closing balance | Omitted movements or changed definitions |
| Data version | Download time, label revision notes and available-at time | Substituting later knowledge into earlier decisions |
| Interpretation | Confirmed purpose, missing purpose and any actual execution evidence | Turning a transfer into an unsupported trade claim |
Use fixed token units and one consistent address set when testing the simple balance identity. If it fails, inspect fees in the measured asset, supply-changing token events, missing records, timing and label changes before treating the gap as an economic signal. A provider's filtered flow series may also have a different scope from its balance series.
For historical research, preserve the first observation and later correction separately. Glassnode's point-in-time documentation describes immutable observations intended to preserve what was known then. It also distinguishes computation from publication time, so a computed timestamp alone should not be assumed to be your retrieval time. Verify the relevant series' coverage and actual availability.
Finally, use the stablecoin supply versus liquidity guide when an alert is being presented as immediate buying capacity. Exchange balances and executable order-book depth require different measurements.
The next flow alert should leave you with a checkable statement: which asset crossed which documented boundary, during which complete window, under which label version. Add a claim about buying, selling or future supply only when separate evidence supports it.