The counter seems to be not correct always, especially if the window is open for a longer time. Sometimes the counter stops completly and sometimes i cannot withdraw in a window, which was open for a longer time. But independent from this counter, the withdraw was always correct for me.
That is the cloudlfare DDoS protection stuff, refresh and all should be well. The same can happen on a level 1 captcha with a window opened for a long time, it cant post to /clear to report that you entered the captcha so it hangs.