CertiK urges crypto exchanges to set hot-wallet loss caps as security benchmark

Traders Union
All News
Crypto
CertiK urges hot-wallet loss caps

Highlights

CertiK urges crypto exchanges to implement hard dollar caps on hot-wallet holdings instead of relying solely on high cold-storage ratios for security.
South Korea, Singapore, Japan, and Hong Kong mandate minimum cold-storage thresholds ranging from 80% to 98%, potentially causing operational trade-offs for exchanges.
Binance has replenished about 98% of hacked tokens and plans to absorb losses, while Elliptic links $430,000 in stolen funds to North Korea-backed memecoin laundering on NEAR.

Security model shifts beyond cold-storage ratios

As reported by Cointelegraph, cybersecurity firm CertiK says exchanges should impose hard dollar caps on hot-wallet holdings instead of relying mainly on cold-storage ratios as a proxy for security.

The recommendation comes after several exchanges disclosed how much of their assets they keep offline to reassure customers following the record Binance hack, which targeted hot wallets. Gate says 88.26% of its total assets are in cold storage, while Coinbase says it keeps more than 99% of customer assets offline.

CertiK's research team says cold storage remains a useful gauge of online exposure, but not a standalone security score. The firm adds that although higher cold-storage levels generally reduce online exposure, the benefit becomes less significant at very high levels.

CertiK says exchanges should set hot-wallet caps for each asset and blockchain based on the strictest of three limits, a share of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling tied to the exchange's financial resources and recovery capacity. It says flexibility should preserve operating liquidity, while hard dollar ceilings and circuit breakers help contain potential losses.

Regulatory backdrop and market implications

Several Asian jurisdictions already prescribe minimum cold-storage thresholds for crypto service providers. South Korea requires at least 80% of customer crypto assets by value to be held in cold storage, while Singapore's guideline is 90%, Japan's framework is 95%, and Hong Kong's baseline for licensed crypto trading platforms is 98%.

CertiK says rigid storage ratios can also create operational trade-offs, including slower withdrawals, rushed transfers and greater concentration of risk in key-management systems. That suggests exchanges may need to balance customer access, liquidity management and loss containment rather than pursue ever-higher offline-storage percentages alone.

Binance says last week that it has replenished about 98% of affected tokens after the hack and will absorb the losses. In a recovery update on Wednesday, the exchange says the remaining tokens are less liquid and will take longer to acquire.

Separately, blockchain analytics firm Elliptic says North Korea-linked hackers have launched memecoins to launder funds from the theft. The firm traces about $430,000 through six new tokens on NEAR, where liquidity pools help obscure wallet-to-wallet transfers even though the movements remain traceable onchain.

Earlier, we reported that global cybersecurity funding reached $6.8 billion in Q3 2023 despite fewer deals, led by larger late-stage rounds.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.