Cybersecurity firm CertiK is calling on crypto exchanges to implement hard dollar limits on hot wallet holdings, moving beyond security models centered solely on cold storage ratios. The recommendation follows the $6.3 billion Binance hack, which specifically targeted the exchange's hot wallets.
"Cold storage is a useful measure of online exposure, but it is not a standalone security score," CertiK's research team said. The firm argues that platforms need a more comprehensive approach to digital asset security.
Binance replenished approximately 98 percent of the affected tokens following the hack, absorbing the losses. The remaining tokens were less liquid and required additional time for acquisition.
CertiK proposes exchanges set hot wallet caps for each asset and blockchain, adhering to the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling tied to the exchange's financial resources and recovery capabilities. "Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss," the firm said.
Rigid cold storage ratios introduce operational friction—slower withdrawal processing, rushed transfers, and concentrated risk within key-management systems that create single points of failure. CertiK noted that while higher cold storage levels reduce online exposure, the benefit diminishes significantly at very high percentages.
Several exchanges have disclosed cold storage holdings to reassure customers. Gate reported 88.26 percent of assets in cold storage, while Coinbase stated it keeps more than 99 percent of customer assets offline.
Regulatory frameworks vary by jurisdiction. South Korea mandates at least 80 percent in cold storage, Singapore requires a minimum of 90 percent, Japan requires at least 95 percent, and Hong Kong's baseline for licensed platforms stands at 98 percent.
In a related development, North Korea-linked hackers used memecoins to launder approximately $430,000 from the Binance theft through six newly launched tokens on the NEAR protocol. Blockchain analytics firm Elliptic traced the flow, showing how liquidity pools on NEAR obscured transfers between wallets, though the transactions remained traceable on-chain.
