Blockchain security firm CertiK is urging crypto exchanges to set hard dollar limits on how much they keep in hot wallets, arguing that cold-storage ratios alone do not provide a complete picture of security. The recommendation follows a record hack at Binance that targeted the exchange's hot wallets.
"Cold storage is a useful measure of online exposure, but it is not a standalone security score," CertiK told Cointelegraph.
What CertiK is proposing
A hot wallet is connected to the internet so an exchange can process withdrawals quickly, while a cold wallet sits offline, making it harder to reach and steal from. Exchanges typically keep only enough in hot wallets to cover a few days of withdrawals, according to Fireblocks.
CertiK flags a problem with how that exposure is measured. A ratio shows what share of assets sits offline, but it says nothing about the actual dollar amount exposed online. Two exchanges that each keep 1% of assets online may look identical by percentage, but if one holds far more in total, its 1% represents a much larger target for an attacker.
A hard dollar cap would put a ceiling on how much an attacker could grab from the online side of the business, regardless of how large the exchange grows.
CertiK analyst Jonathan Riss argued that cold-to-hot percentages miss key parts of the security picture, particularly internal controls and transaction limits, which determine how money actually moves once it is in the hot wallet.
The Binance hack that started the conversation
On October 29, 2026, attackers breached Binance's internal wallet-signing service and drained approximately $6.34 billion from its hot wallets across 10 chains. CertiK's dashboard recorded approximately $6.39 billion in losses for October 2026, with the Binance incident as the primary contributor.
Rival exchanges moved quickly to reassure users. Coinbase disclosed that it keeps over 99% of assets in cold storage. South Korea's Upbit reported 99.17% in cold storage, while Gate reported 88.26% cold-storage coverage. Gate also rolled out a "Proof of Security" framework after the incident.
Regulators are paying attention
The breach has pushed custody controls up the agenda beyond exchange marketing teams. Authorities in South Korea have called for stringent cold-storage minimums.
That approach still centers on ratios, the very metric CertiK says cannot carry the full weight of a security assessment. A minimum percentage can be useful as a floor, but it does not cap the absolute dollars at risk.
What this means for exchanges and users
For users, the takeaway is to read cold-storage disclosures with some skepticism. More important are operational questions: how transactions are approved, who can move money out of hot wallets, and whether there are limits on single transfers. Riss's point about internal controls and transaction limits gets at precisely these issues.
For exchanges, a dollar cap carries real trade-offs. Keeping less online means refilling hot wallets more often from cold storage, which takes time and adds steps to the process. During periods of heavy withdrawals, a tight cap could slow payouts.
