CertiK urges crypto exchanges to cap hot wallet holdings

The original uploader was Ladislav Mecir at English Wikipedia. / Wikimedia Commons (CC BY-SA 3.0)

After the record Binance hack, the security firm says cold-storage percentages alone don't tell users how safe their funds are

Tue 10 Nov 2026 · 00:28 EST · 3 min read

In Security

Crypto exchanges have spent the past few weeks publishing their cold-storage ratios, hoping big percentages will calm nervous customers. CertiK thinks the industry is grading itself on the wrong test.

The blockchain security firm says exchanges should set hard dollar limits on how much they keep in hot wallets, instead of leaning on cold-storage ratios as a stand-in for security. The advice lands after the Binance hack, which went straight for the exchange’s hot wallets.

“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK told Cointelegraph.

What CertiK is actually proposing

A hot wallet is connected to the internet so an exchange can process withdrawals quickly, while a cold wallet sits offline, harder to reach and harder to steal from.

Exchanges need that cash drawer. According to Fireblocks, exchanges typically keep only enough in hot wallets to cover a few days of withdrawals.

The problem CertiK flags is how that drawer gets measured. A ratio tells you what share of assets sits offline, but it says nothing about the actual dollar amount exposed online.

Picture two exchanges that each keep 1% of assets online. If one holds far more in total, its 1% is a much juicier target. The percentage looks identical. The prize for an attacker does not.

A hard dollar cap fixes that blind spot. It puts a ceiling on how much an attacker could grab from the online side of the business, no matter how large the exchange grows.

CertiK analyst Jonathan Riss argued that cold-to-hot percentages miss key parts of the security picture. In particular, they ignore factors like internal controls and transaction limits, which decide how money actually moves once it’s in the hot wallet.

The Binance hack that started the conversation

On October 29, 2026, attackers breached Binance’s internal wallet-signing service and drained approximately $6.34 billion from its hot wallets across 10 chains.

CertiK’s dashboard recorded approximately $6.39 billion in losses for October 2026, with the Binance incident as the primary contributor.

Rival exchanges moved fast to reassure their own users. Coinbase disclosed that it keeps over 99% of assets in cold storage.

South Korea’s Upbit reported 99.17% in cold storage. Gate came in at 88.26% cold-storage coverage.

Gate went a step further, rolling out a “Proof of Security” framework after the incident.

Regulators are paying attention too

The breach has pushed custody controls up the agenda well beyond exchange marketing teams. Authorities in South Korea have called for stringent cold-storage minimums.

That approach still centers on ratios, which is exactly the metric CertiK says can’t carry the full weight of a security assessment. A minimum percentage can be useful as a floor, but it doesn’t cap the absolute dollars at risk.

What this means for exchanges and users

For users, the takeaway is to read those cold-storage disclosures with some skepticism. The questions that matter more are operational: how are transactions approved, who can move money out of hot wallets, and are there limits on single transfers. Riss’s point about internal controls and transaction limits gets at precisely these issues.

For exchanges, a dollar cap carries real trade-offs. Keeping less online means refilling hot wallets more often from cold storage, which takes time and adds steps to the process. During periods of heavy withdrawals, a tight cap could slow payouts.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.