CertiK: Crypto exchanges should set dollar caps on hot wallets, not just cold-storage ratios

Security firm says cold-storage ratios alone do not show real risk

Cybersecurity firm CertiK says crypto exchanges should put hard dollar limits on the funds they keep in hot wallets, instead of relying only on cold-storage ratios to measure security. A hot wallet is an online wallet used for daily withdrawals. Cold storage means keeping crypto offline, away from direct internet access.

The recommendation comes after several exchanges recently shared how much crypto they keep in cold storage, trying to reassure customers following a record hack of Binance that targeted its hot wallets.

Key points from CertiK's advice

• Cold storage shows online exposure, but CertiK says it is "not a standalone security score."
• CertiK suggests setting a hot-wallet cap for each asset and blockchain, based on the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling tied to the exchange's financial resources and recovery ability.
• The firm says flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss.
• Rigid storage ratios could slow withdrawals, force rushed transfers, and concentrate risk in key-management systems.

What CertiK told Cointelegraph

"Cold storage is a useful measure of online exposure, but it is not a standalone security score," CertiK's research team told Cointelegraph.

The firm also said that while higher cold-storage levels generally reduce online exposure, the benefit becomes less significant at very high levels.

What exchanges and regulators report

Some exchanges have published their cold-storage figures. Gate reported that 88.26% of its total assets were in cold storage, while Coinbase said it keeps more than 99% of customer assets offline.

Regulators in several countries already set minimum cold-storage requirements. South Korea requires crypto service providers to keep at least 80% of customers' crypto assets by value in cold storage. Singapore's guidelines call for at least 90%. Japan's framework requires at least 95%, and Hong Kong's baseline for licensed crypto trading platforms is 98%.

Binance recovery and the laundering trail

Binance said last week it had replenished about 98% of the tokens affected by the hack and would absorb the losses. In a recovery update on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.

Meanwhile, blockchain analytics firm Elliptic reported that North Korea-linked hackers created memecoins to launder funds from the theft. Elliptic traced roughly $430,000 through six newly launched tokens on the NEAR blockchain. Liquidity pools there helped obscure transfers between wallets, though the transactions remained traceable onchain.

What is confirmed and what is opinion

Confirmed from the sources: the exchange disclosures from Gate and Coinbase, the cold-storage rules in South Korea, Singapore, Japan, and Hong Kong, Binance's statement about replenishing about 98% of affected tokens, and Elliptic's report on the $430,000 traced through six memecoins on NEAR.

CertiK's hot-wallet cap proposal is the firm's recommendation, not a rule that exchanges must follow. No exchange has announced such caps in the supplied material.

Why this matters for exchange customers

Hot wallets are the part of an exchange's holdings most exposed to hackers, as the Binance hack showed. CertiK's argument is that a dollar-based loss ceiling gives a clearer picture of worst-case losses than a cold-storage percentage alone. Customers watching exchanges publish cold-storage figures may want to treat those numbers as one measure among several.

Sources

• Cointelegraph