Exchanges Flash Cold Wallet Ratios After Binance Hot Wallet Heist

Attackers hit Binance's hot-wallet infrastructure last week, hauling off roughly $6.36 billion — most of it in about 20 minutes, according to blockchain forensics firm TRM Labs. CEO Richard Teng has said the overwhelming majority of user assets sit in cold wallets, but Binance still hasn't handed over a precise split. Rivals rushed to fill that silence within days.

Gate moved first on Thursday, rolling out a framework it calls Proof of Security. The exchange says 88.26% of its total assets live in cold storage and 11.74% in hot wallets, and that its offline holdings alone could cover 104.58% of customer assets even if every hot wallet were emptied. Gate noted the numbers are still being checked by an outside audit firm.

Coinbase followed on Wednesday, saying more than 99% of customer assets are parked in offline cold storage and that it keeps sweeping excess assets out of reach of the internet. The company acknowledged the obvious: Binance's reported hot wallet incident has customers asking how Coinbase would handle the same scenario.

Upbit, South Korea's biggest exchange, confirmed Tuesday it holds 99.17% of assets in cold wallets and 0.83% in hot ones as of September 2026 — figures already disclosed to the country's Financial Supervisory Service. A spokesperson for parent company Dunamu told Cointelegraph that's the highest cold-storage share among South Korea's five major KRW-based exchanges, comfortably above the 80% regulatory minimum, and that the target is keeping hot wallets under 1% of customer assets.

The rest of the Korean field runs lower. FSS figures cited in earlier reporting put Bithumb at 94.76%, Coinone at 85%, Digital X (formerly Korbit) at 82.79% and GOPAX at 80.54% at the end of September. OKX's own security overview, last updated Sept. 18, 2026, claims more than 95% of client crypto in cold wallets and under 5% in hot.

A fat cold-storage ratio isn't a guarantee of anything. Exchanges use different reporting periods and may measure against different asset bases, so the numbers aren't directly comparable. And offline wallets can still be cracked through compromised signing systems, sloppy access controls or an employee approving a fraudulent transfer — weaknesses Hong Kong's Securities and Futures Commission flagged in an August 2025 circular as threats to hot and cold infrastructure alike.