CertiK urges crypto exchanges to cap hot-wallet holdings

Cybersecurity firm CertiK has urged crypto exchanges to impose dollar limits on hot-wallet holdings instead of relying solely on cold-storage ratios to assess the security of customer assets.

The recommendation followed disclosures from several exchanges about the share of assets held offline after a record Binance hack targeted hot wallets. Gate reported that 88.26% of its total assets were in cold storage. Coinbase reported that more than 99% of customer assets were kept offline.

“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team said.

CertiK recommended setting a separate hot-wallet limit for each asset and blockchain. The limit should use the strictest of three measures: a percentage of customer liabilities, the amount needed to meet expected withdrawals and an absolute loss ceiling based on the exchange’s financial resources and ability to recover from an incident.

Higher cold-storage levels generally reduce the amount of assets exposed online, CertiK said. The security benefit becomes smaller at very high levels, while rigid storage ratios could delay withdrawals, prompt rushed transfers and concentrate risk in key-management systems.

The firm recommended combining operating liquidity with dollar ceilings and circuit breakers that can halt activity when limits are reached.

Several jurisdictions have set minimum cold-storage requirements for crypto service providers. South Korea requires at least 80% of customer crypto assets by value to be held in cold storage. Singapore’s guidelines call for at least 90%, Japan requires at least 95% and Hong Kong sets a 98% baseline for licensed crypto trading platforms.

Binance reported in a recovery update that it had replaced about 98% of the tokens affected by the hack and would absorb the losses. The exchange said the remaining tokens were less liquid and would take longer to acquire.

Blockchain analysis firm Elliptic reported that North Korea-linked hackers had created memecoins to launder proceeds from the theft. Elliptic traced about $430,000 through six newly launched tokens on the NEAR network. Liquidity pools obscured transfers between wallets, although the transactions remained visible onchain.

Reviewed and fact-checked by Alex Panasenko on November 10.