CertiK Urges Hard Dollar Caps on Exchange Hot Wallets

Crypto exchanges should impose hard dollar limits on their hot-wallet holdings rather than relying solely on cold-storage ratios to measure security, according to cybersecurity firm CertiK.

The recommendation follows recent disclosures by several platforms regarding their cold-wallet reserves following the record Binance hack that targeted hot-wallet infrastructure. Crypto exchange Gate reported that 88.26% of its total assets were in cold storage, while Coinbase stated it keeps more than 99% of customer assets offline.

Regulatory Frameworks and Limitations

Several jurisdictions already mandate minimum cold-storage thresholds. South Korea requires service providers to keep at least 80% of customer crypto assets by value in cold storage, while Singapore's guidelines call for at least 90%. Japan's framework requires at least 95%, and Hong Kong's baseline for licensed trading platforms sits at 98%.

However, CertiK noted that while higher cold-storage levels generally reduce online exposure, the marginal security benefit decreases significantly at very high percentages. Furthermore, rigid storage ratios can slow down withdrawals, force rushed transfers, and concentrate risk within key-management systems.

Proposed Limits and Recovery Updates

CertiK recommended that exchanges set hot-wallet caps for each asset and blockchain based on the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling derived from the exchange's financial resources and recovery capabilities.

In related security developments, Binance reported last week that it had replenished approximately 98% of the tokens affected by its recent hack and intends to absorb the losses. The exchange noted that the remaining tokens are less liquid and will require more time to acquire.

Key facts

• CertiK recommended hard dollar caps on hot-wallet holdings for crypto exchanges.
• South Korea, Singapore, Japan, and Hong Kong maintain cold-storage mandates ranging from 80% to 98%.
• Binance stated it has replaced approximately 98% of tokens affected by its recent hack.