Hot wallets need cold feet: CertiK says exchanges should set hard dollar limits 🔐

Crypto exchanges should establish hard dollar limits on hot-wallet holdings rather than treating cold-storage ratios as the sole measure of security, according to cybersecurity firm CertiK. The recommendation follows disclosures from Gate and Coinbase and comes after the record $6.3B Binance hack targeted its hot wallets.

Gate reported that 88.26% of its total assets were in cold storage, while Coinbase said it keeps more than 99% of customer assets offline. “Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.

Cold-storage requirements also vary by jurisdiction. South Korea requires crypto service providers to keep at least 80% of customers’ crypto assets by value in cold storage, while Singapore’s guidelines call for at least 90%, Japan’s framework requires at least 95%, and Hong Kong’s baseline for licensed crypto trading platforms is 98%.

CertiK said higher cold-storage levels generally reduce online exposure, but the benefit becomes less significant at very high levels. Rigid storage ratios could also slow withdrawals, prompt rushed transfers and concentrate risk in key-management systems. The firm recommended setting hot-wallet caps for each asset and blockchain according to the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling based on the exchange’s financial resources and recovery capabilities. “Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” they said.

Binance last week said it had replenished approximately 98% of affected tokens following the hack and would absorb the losses. In a Wednesday recovery update, the exchange said the remaining tokens were less liquid and would take longer to acquire. Separately, North Korea-linked hackers created memecoins to launder funds from the theft, according to Elliptic. The firm traced roughly $430,000 through six newly launched tokens on NEAR, where liquidity pools obscured transfers between wallets, although the transactions remained traceable onchain.