CertiK, a leading blockchain cybersecurity firm, has recommended that cryptocurrency exchanges establish explicit dollar caps on their hot-wallet holdings rather than relying solely on high cold-storage ratios to ensure security.
Focus shifts from cold storage ratios to absolute limits
This recommendation follows increased transparency by several crypto exchanges regarding their cold-wallet reserves after the record $6.3 billion Binance hack, which targeted hot wallets. Gate, a global crypto exchange, recently reported that 88.26% of its assets are stored in cold wallets. Meanwhile, Coinbase, one of the largest US-based digital asset platforms, stated it holds over 99% of customer assets offline.
CertiK’s research team emphasized that while cold storage helps reduce online exposure, the percentage of assets kept offline should not be viewed as a standalone measure of security. The experts noted that extremely high cold-storage ratios might provide diminishing benefits, as the marginal reduction in online exposure lessens as the ratio rises.
Cold storage ratios offer insight into online exposure, but robust security requires more than just high percentages; setting limits by asset and blockchain helps exchanges manage operational risk and protect against potential losses.
Several regulatory authorities have imposed minimum thresholds for cold storage holdings. South Korea’s rules require service providers to keep at least 80% of customers’ cryptocurrencies in cold storage by value. Singapore sets the bar at 90%, Japan at 95%, and Hong Kong at 98% for licensed crypto trading platforms.
CertiK argued that strictly following these ratios could have unintended negative consequences. For instance, rigid requirements might slow down customer withdrawals, lead firms to rush large transfers under pressure, or centralize risk within specific key management systems.
Instead, CertiK advised exchanges to implement hot-wallet caps for every supported asset and blockchain, using the strictest value derived from three possible limits: a percentage of customer liabilities, projected withdrawal needs, and an absolute loss ceiling based on available financial resources and recovery abilities.
Appropriate liquidity should be maintained for smooth operations, but hard dollar ceilings and automated circuit breakers are essential to limit maximum potential losses.
Mini dictionary: CertiK is a cybersecurity firm specializing in blockchain technology, known for conducting security audits of smart contracts and digital asset platforms.
Binance recovers most stolen assets as laundering attempts continue
Binance announced that it had replenished approximately 98% of tokens affected by the hack and confirmed it would absorb the financial losses. The exchange noted that the recovery of the remaining funds is progressing more slowly due to low liquidity of the specific tokens involved.
Elliptic, a blockchain analysis company, reported that North Korea-linked hacking groups have issued six new memecoins on the NEAR blockchain to launder around $430,000 from the Binance theft. Liquidity pools on NEAR were used to mask wallet transfers, but investigators stated that transactions remain trackable on the blockchain.
The situation has raised fresh concerns about the sufficiency of existing risk controls and the ongoing threat of sophisticated cybercriminal groups exploiting emerging decentralized finance ecosystems.
| Country / Region | Minimum Cold Storage Requirement (%) |
|---|---|
| South Korea | 80 |
| Singapore | 90 |
| Japan | 95 |
| Hong Kong | 98 |
| Coinbase (Reported Level) | 99+ |
| Gate (Reported Level) | 88.26 |
