Original report published by Cointelegraph on November 10, 2026, at 13:05:58 UTC+8.
Crypto exchanges should set hard dollar limits on assets held in hot wallets rather than treat cold-storage percentages as a complete security measure, cybersecurity firm CertiK told Cointelegraph.
The recommendation followed disclosures by exchanges seeking to reassure customers after a record Binance hack targeting its hot wallets. Gate reported holding 88.26% of its total assets in cold storage, while Coinbase said it keeps more than 99% of customer assets offline.
What cold-storage ratios leave out
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team said.
Cold-storage requirements vary across jurisdictions:
- South Korea: At least 80% of customers’ crypto assets by value.
- Singapore: Guidelines call for at least 90%.
- Japan: The framework requires at least 95%.
- Hong Kong: The baseline for licensed crypto trading platforms is 98%.
CertiK said higher cold-storage levels generally reduce online exposure, but the incremental benefit diminishes at very high levels. Rigid ratios can also slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
Instead, the firm proposed hot-wallet caps for each asset and blockchain, using the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, or an absolute loss ceiling tied to the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the team said.
Binance recovery and reported laundering
In the week before the original report, Binance said it had replenished approximately 98% of affected tokens following the hack and would absorb the losses. In a recovery update on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.
Separately, blockchain analytics firm Elliptic said North Korea-linked hackers had created memecoins to launder proceeds from the theft. Elliptic traced roughly $430,000 through six newly launched tokens on NEAR, where liquidity pools helped obscure transfers between wallets. The transactions nevertheless remained traceable onchain, according to the firm.
The distinction in CertiK’s recommendation is straightforward: a high offline-storage percentage measures one aspect of exposure, not the maximum amount an exchange could lose from its hot wallets.