Source published: November 10, 2026, at 13:05:58 UTC+08:00. This article reflects the reporting available at that time.
The question: how much can an exchange afford to expose?
Crypto exchanges should impose hard dollar ceilings on hot-wallet holdings rather than assess security solely through cold-storage percentages, cybersecurity firm CertiK told Cointelegraph.
The distinction is between the share of assets kept offline and the absolute amount exposed online. A high cold-storage ratio can reduce online exposure, but it does not, by itself, establish how much an exchange could lose or whether it could recover from that loss.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team said.
The recommendation followed disclosures by exchanges seeking to reassure customers after what the report described as a record Binance hack targeting its hot wallets. Gate reported holding 88.26% of its total assets in cold storage, while Coinbase said it keeps more than 99% of customer assets offline. These disclosures use different asset categories—total assets versus customer assets—and should not be treated as directly equivalent measures.
What storage thresholds measure—and what they leave unresolved
The report outlined several jurisdictions’ cold-storage requirements or guidelines:
- South Korea: Crypto service providers must keep at least 80% of customers’ crypto assets, measured by value, in cold storage.
- Singapore: Guidelines call for at least 90%.
- Japan: The framework requires at least 95%.
- Hong Kong: The baseline for licensed crypto trading platforms is 98%.
CertiK said higher cold-storage levels generally reduce online exposure, but the incremental benefit becomes less significant at very high levels. It also warned that rigid ratios could slow withdrawals, require rushed transfers and concentrate risk in key-management systems.
The trade-off is therefore not simply whether more assets should be offline. It is how an exchange limits online losses while maintaining enough accessible liquidity to process withdrawals without creating additional operational risk.
CertiK’s proposed control: three limits, applied together
CertiK recommended setting hot-wallet caps separately for each asset and blockchain, using the strictest of three constraints:
- A percentage of customer liabilities.
- Estimated withdrawal needs.
- An absolute loss ceiling tied to the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the research team said.
This is a proposed risk-control framework, not evidence that exchanges have implemented it. The supplied report gives no numerical settings for these caps, no circuit-breaker specifications and no comparative test of their effectiveness. Its central argument is narrower: cold-storage ratios should be supplemented with explicit limits on the amount at risk.
Recovery and tracing context
At the time of the report, Binance said it had replenished approximately 98% of affected tokens following the hack and would absorb the losses. In a recovery update described as having been issued on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire. The 98% figure referred to affected tokens replenished, not a stated percentage of dollar losses recovered.
Separately, Elliptic said North Korea-linked hackers had created memecoins to launder proceeds from the theft. The firm traced roughly $430,000 through six newly launched tokens on NEAR. According to Elliptic, liquidity pools helped obscure transfers between wallets, although the transactions remained traceable onchain.
These recovery and tracing updates do not establish the effectiveness of CertiK’s proposed controls. They provide context for its recommendation: exchange custody risk needs to be assessed in terms of potential loss and recovery capacity, not just the percentage of assets held offline.
Original source: Cointelegraph — “Crypto exchanges need hard dollar caps on hot wallets, CertiK says”.