Blockchain security firm CertiK is urging cryptocurrency exchanges to introduce strict dollar-denominated limits on their hot-wallet holdings instead of relying primarily on cold-storage ratios to demonstrate asset security.
The recommendation follows the record $6.3 billion Binance cryptocurrency hack, which exposed the risks associated with internet-connected wallets and raised questions about how exchanges control access to customer assets.
In comments reported by Cointelegraph on November 10, CertiK argued that cold-storage percentages provide only a partial picture of an exchange’s security. The firm believes exchanges should establish maximum hot-wallet exposure based on customer liabilities, expected withdrawal demand and the amount of money they can afford to lose in a security incident.
The proposal comes as major cryptocurrency exchanges disclose their cold-storage arrangements to reassure customers following the Binance breach.
CertiK Says Cold Storage Ratios Are Not Enough
Cold storage is one of the primary security measures used by cryptocurrency exchanges. It involves keeping private keys offline, reducing exposure to internet-based attacks.
Hot wallets, by comparison, remain connected to the internet and are used to process deposits, withdrawals and other transactions requiring immediate access to cryptocurrency.
Although keeping most customer assets offline can reduce the amount exposed to online attacks, CertiK says the percentage alone does not establish how much an exchange could lose if its hot-wallet infrastructure is compromised.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.
For example, an exchange holding 99% of customer assets in cold storage could still have billions of dollars exposed online if its overall asset base is sufficiently large.
CertiK therefore believes security assessments should consider the actual dollar value held in hot wallets, rather than focusing exclusively on the percentage of assets stored offline.
Three Limits CertiK Wants Exchanges to Adopt
CertiK recommends that cryptocurrency exchanges establish hot-wallet limits for individual assets and blockchains using three main considerations.
The strictest applicable limit should determine how much cryptocurrency an exchange can keep in its online wallets.
1. Percentage of customer liabilities
Exchanges should calculate hot-wallet exposure relative to their customer liabilities. This would help prevent online balances from becoming disproportionately large compared with the assets owed to customers.
2. Expected withdrawal requirements
Hot wallets need sufficient liquidity to process normal customer withdrawals. Exchanges should estimate expected withdrawal demand and maintain enough online funds to support operations without unnecessarily increasing exposure.
3. Absolute loss ceiling
Exchanges should also establish a maximum dollar amount they could potentially lose in a security breach, taking into account their financial resources and recovery capabilities.
Under this approach, an exchange would not be able to justify holding an extremely large hot-wallet balance simply because it represents a small percentage of total customer assets.
CertiK also recommends circuit breakers and flexible liquidity management. These controls could help exchanges maintain normal withdrawal operations while limiting the potential damage from compromised systems.
Binance Hack Exposes the Risks of Hot Wallet Security
The recommendation follows the October 29 Binance security incident, in which approximately $6.3 billion in cryptocurrency was affected across 10 blockchain networks.
The attack targeted an internet-connected Binance hot wallet. The exchange subsequently confirmed that its own wallet infrastructure had been compromised.
Blockchain investigators reported that attackers used sophisticated techniques to obtain transaction authorisations and move cryptocurrency. The incident also involved the exploitation of Ethereum’s EIP-7702 functionality to facilitate a major asset transfer.
The FBI later attributed the attack to North Korean-linked cyber actors associated with the TraderTraitor group.
Binance said it would absorb the losses rather than pass them on to customers. The exchange has also reported that it replenished approximately 98% of the affected tokens, with the remaining assets taking longer to replace because of lower market liquidity.
The incident highlighted an important security distinction: keeping most assets in cold storage does not eliminate the risk associated with the smaller portion held online.
If attackers compromise the systems responsible for authorising transactions, even a relatively small hot-wallet allocation can represent a substantial financial exposure.
Crypto Exchanges Disclose Cold Storage Ratios After Binance Breach
Following the Binance incident, several cryptocurrency exchanges publicly highlighted the proportion of customer assets they keep offline.
According to Cointelegraph’s reporting, Gate disclosed that approximately 88.26% of its total assets were held in cold storage.
Coinbase said it keeps more than 99% of customer assets offline.
These disclosures are intended to demonstrate that exchanges limit the amount of cryptocurrency exposed to internet-connected systems.
However, CertiK’s recommendation suggests that customers and regulators should also examine the absolute value of online holdings and the controls governing transactions.
An exchange’s cold-storage percentage may look strong on paper, but the actual financial risk depends on the value held in hot wallets and how effectively the exchange can prevent unauthorised transfers.
Different Countries Have Introduced Cold Storage Requirements
Regulators in several financial markets have already introduced minimum cold-storage requirements for cryptocurrency service providers.
According to Cointelegraph, the current requirements or regulatory baselines include:
| Jurisdiction | Cold-storage requirement |
|---|---|
| South Korea | At least 80% |
| Singapore | At least 90% |
| Japan | At least 95% |
| Hong Kong | 98% baseline for licensed platforms |
These rules aim to reduce the amount of customer cryptocurrency exposed to online threats.
However, CertiK’s proposal focuses on an additional layer of protection rather than replacing cold-storage requirements.
A percentage-based rule determines how much of an exchange’s assets must remain offline. A hard dollar cap would separately limit the maximum amount that can be exposed through hot wallets.
Together, the two approaches could provide regulators and customers with a clearer picture of an exchange’s potential losses in the event of a security breach.
Why Hard Dollar Limits Could Improve Crypto Exchange Security
A fixed exposure limit could help prevent a compromised hot wallet from becoming a single point of failure capable of exposing billions of dollars in customer assets.
It could also encourage exchanges to introduce more sophisticated treasury management systems, separating routine withdrawal liquidity from larger reserves.
However, implementing strict limits would require careful planning.
Exchanges process different withdrawal volumes depending on market conditions, customer activity and the blockchain networks they support. A single fixed limit across every cryptocurrency could create operational problems.
For this reason, CertiK recommends calculating limits separately for each asset and blockchain.
Exchanges may also need intermediate wallets, additional approval procedures and automated circuit breakers to replenish hot wallets without creating unnecessary exposure.
The challenge will be balancing operational liquidity with security. Excessively restrictive limits could delay legitimate withdrawals, while overly generous limits could leave substantial funds vulnerable.
What the Proposal Means for Crypto Investors
For cryptocurrency investors, the discussion highlights why an exchange’s proof of reserves or cold-storage percentage should not be treated as a complete measure of security.
Customers may also want to understand how an exchange protects its signing infrastructure, controls withdrawals, monitors wallet permissions and responds to suspicious transactions.
The Binance breach demonstrates that the security of cryptocurrency holdings depends on more than where assets are stored. The systems responsible for authorising and executing transfers are equally important.
CertiK’s proposal could encourage exchanges to publish more detailed information about their hot-wallet exposure and risk controls, although the recommendation is not itself a new regulatory requirement.
Bottom Line
CertiK wants cryptocurrency exchanges to introduce hard dollar-denominated limits on hot-wallet holdings instead of relying only on cold-storage ratios.
The proposal follows the $6.3 billion Binance hack and calls for exchanges to calculate exposure using customer liabilities, expected withdrawal requirements and an absolute loss ceiling based on their financial capacity.
While cold storage remains an important security measure, CertiK argues that exchanges also need clear limits on how much cryptocurrency can be exposed to online attacks.
The recommendation could influence future exchange security standards as regulators and investors demand stronger safeguards following major cryptocurrency thefts.
Disclaimer: This article is for informational purposes only and does not constitute investment or financial advice. CertiK’s recommendations represent a proposed security approach, not a universally adopted regulatory requirement.
Also Check: Bitcoin, Ethereum, Solana and XRP ETFs Record $1.67 Billion in Weekly Outflows
