Originally published by Cointelegraph on November 10, 2026, at 13:05:58 UTC+8.
Crypto exchanges should cap the dollar value held in hot wallets rather than rely solely on the percentage of assets kept offline, cybersecurity firm CertiK told Cointelegraph. Its recommendation followed exchange disclosures intended to reassure customers after what the report described as a record Binance hack targeting hot wallets.
The distinction is between the share of assets exposed online and the amount an exchange could lose. CertiK proposed linking hot-wallet limits to customer liabilities, withdrawal requirements and the exchange’s ability to absorb and recover from losses.
What cold-storage disclosures show
Gate reported holding 88.26% of its total assets in cold storage, while Coinbase said it keeps more than 99% of customer assets offline. The disclosures use different asset bases: Gate’s figure refers to total assets; Coinbase’s refers to customer assets.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.
The report outlined several jurisdictions’ cold-storage thresholds:
- South Korea: At least 80% of customers’ crypto assets by value.
- Singapore: Guidelines call for at least 90%.
- Japan: Its framework requires at least 95%.
- Hong Kong: A 98% baseline applies to licensed crypto trading platforms.
According to CertiK, higher cold-storage levels generally reduce online exposure, but the additional benefit diminishes at very high levels. Rigid ratios could also slow withdrawals, require rushed transfers and concentrate risk in key-management systems.
Tie wallet limits to liabilities and loss capacity
CertiK recommended setting hot-wallet caps separately for each asset and blockchain, using the strictest of three limits:
- A percentage of customer liabilities.
- Estimated withdrawal needs.
- An absolute loss ceiling based on the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the researchers said.
The proposal treats offline-storage percentages as one exposure measure, rather than a complete assessment of custody security.
Binance’s reported replenishment and tracing update
In the week before the article’s publication, Binance said it had replenished approximately 98% of affected tokens and would absorb the hack’s losses. In a recovery update described in the report as issued on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.
Separately, Elliptic said North Korea-linked hackers had created memecoins to launder funds from the theft. The firm traced roughly $430,000 through six newly launched tokens on NEAR. According to Elliptic, liquidity pools helped obscure transfers between wallets, although the transactions remained traceable onchain.