Exchanges should cap hot wallets in dollars, not cold ratios, CertiK says

Crypto exchanges should set absolute dollar ceilings on how much they keep in hot wallets, cybersecurity firm CertiK told Cointelegraph. The firm argues that cold-storage ratios alone don't tell customers how much a breach could actually cost. Its recommendation arrives as exchanges rush to publish how much of their holdings sit offline.

Gate reported that 88.26% of its total assets are held in cold storage. Coinbase says it keeps more than 99% of customer assets offline. Both disclosures followed the record Binance hack, which hit hot wallets, and the industry's scramble to reassure users. According to CertiK's research team, cold storage is a useful measure of online exposure, but it is not a standalone security score.

Regulators have already baked in hard ratios: South Korea requires providers to hold at least 80% of customer crypto by value in cold storage, Singapore's guidelines call for 90%, Japan's framework 95% and Hong Kong's baseline for licensed trading platforms 98%. CertiK says the security payoff flattens at very high levels. Worse, rigid ratios can slow withdrawals, force rushed transfers and pile risk into key-management systems.

CertiK's alternative: set hot-wallet caps for each asset and blockchain, taking the strictest of three limits. Those are a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling based on the exchange's own financial resources and recovery capabilities. Flexibility should support operating liquidity, the team said, while hard dollar ceilings and circuit breakers limit potential loss.

Binance said last week it had replenished roughly 98% of the tokens affected in the hack and would absorb the losses. In a Wednesday recovery update, the exchange said the remaining tokens were less liquid and would take longer to acquire. Meanwhile, Elliptic reported that North Korea-linked hackers created memecoins to launder stolen funds, tracing about $430,000 through six newly launched tokens on NEAR. Liquidity pools there helped obscure transfers between wallets, though the transactions stayed traceable onchain.