Original report published November 10, 2026, at 13:05:58 UTC+08:00.
Crypto exchanges should set hard dollar limits on assets held in hot wallets rather than treat cold-storage percentages as a complete measure of security, cybersecurity firm CertiK told Cointelegraph.
The recommendation followed disclosures by exchanges seeking to reassure customers after what the report described as a record Binance hack targeting its hot wallets. Gate reported holding 88.26% of its total assets in cold storage, while Coinbase said it keeps more than 99% of customer assets offline. Those disclosures use different asset bases: Gate referred to total assets, while Coinbase referred to customer assets.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team said.
Custody thresholds differ across jurisdictions
The report outlined several jurisdictions’ cold-storage standards:
- South Korea: Crypto service providers must keep at least 80% of customers’ crypto assets, measured by value, in cold storage.
- Singapore: Guidelines call for at least 90%.
- Japan: The framework requires at least 95%.
- Hong Kong: Licensed crypto trading platforms face a baseline of 98%.
CertiK said higher cold-storage levels generally reduce online exposure, but the incremental benefit diminishes at very high levels. Rigid ratios can also slow withdrawals, require rushed transfers and concentrate risk in key-management systems.
A proposed cap based on potential losses
CertiK recommended setting hot-wallet caps for each asset and blockchain using the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling tied to the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the team said.
This was a recommendation from the cybersecurity firm, not a newly adopted regulatory requirement.
Binance recovery and tracing efforts
The November 10 report said Binance had announced the previous week that it had replenished approximately 98% of affected tokens and would absorb the losses. In a recovery update described as having been issued on Wednesday, Binance said the remaining tokens were less liquid and would take longer to acquire.
Separately, blockchain analytics firm Elliptic said North Korea-linked hackers had created memecoins to launder proceeds from the theft. Elliptic traced roughly $430,000 through six newly launched tokens on NEAR. Liquidity pools helped obscure transfers between wallets, according to the firm, although the transactions remained traceable onchain.