CertiK says crypto exchanges need hard dollar caps on hot-wallet holdings
In brief
- CertiK: exchanges should set hard dollar limits on hot wallets, not rely solely on cold-storage ratios.
- Gate reported 88.26% of assets in cold storage; Coinbase said more than 99% sits offline.
- CertiK proposes per-asset, per-chain caps set by the strictest of three limits.
- Elliptic linked memecoin laundering of Binance hack funds to North Korea-linked hackers.
Exchanges and regulators lean on percentages
Several exchanges recently disclosed their cold-wallet holdings. Gate reported that 88.26% of its total assets were in cold storage, and Coinbase said it keeps more than 99% of customer assets offline.
Regulators use the same yardstick. South Korea requires crypto service providers to keep at least 80% of customers' crypto assets by value in cold storage, while Singapore's guidelines call for at least 90%, Japan's framework requires at least 95% and Hong Kong's baseline for licensed trading platforms is 98%.
Every one of those rules is expressed as a percentage.
Why CertiK says ratios aren't enough
CertiK said higher cold-storage levels generally reduce online exposure, but the benefit becomes less significant at very high levels. It's not just diminishing returns, either. The firm's report said rigid storage ratios could slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.
So what's the alternative? CertiK said exchanges should consider setting hot-wallet caps for each asset and blockchain according to the strictest of three limits (a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling based on the exchange's financial resources and recovery capabilities). In CertiK's view, flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss.
Binance's recovery and the laundering trail
Cointelegraph has put the Binance hack at $6.3 billion, reporting that analysts saw no broader contagion. Binance said last week it had replenished approximately 98% of affected tokens and would absorb the losses. In a recovery update on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.
The stolen funds haven't sat still. According to Elliptic, North Korea-linked hackers created memecoins to launder funds from the theft. Elliptic traced roughly $430,000 through six newly launched tokens on NEAR, where liquidity pools helped obscure transfers, though the transactions remained traceable onchain.
Frequently asked questions
What hot-wallet limits did CertiK propose for crypto exchanges?
CertiK said exchanges should consider setting hot-wallet caps for each asset and blockchain according to the strictest of three limits. Those limits are a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling based on the exchange's financial resources and recovery capabilities.
Why does CertiK say cold-storage ratios aren't enough?
CertiK said higher cold-storage levels generally reduce online exposure, but the benefit becomes less significant at very high levels. Its report added that rigid storage ratios could slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
How much cold storage do regulators require from crypto exchanges?
South Korea requires crypto service providers to keep at least 80% of customers' crypto assets by value in cold storage. Singapore's guidelines call for at least 90%, Japan's framework requires at least 95%, and Hong Kong's baseline for licensed trading platforms is 98%.
