Key facts
- CertiK recommended exchanges set hot-wallet caps at the strictest of three limits: customer liabilities, withdrawal needs and an absolute loss ceiling.
- Gate reported 88.26% of its total assets in cold storage; Coinbase said more than 99% of customer assets are offline.
- CertiK said rigid storage ratios could slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
- Binance said it had replenished approximately 98% of affected tokens after the hack and would absorb the losses.
- Elliptic said North Korea-linked hackers created memecoins to launder funds, tracing roughly $430,000 through six tokens on NEAR.
Cybersecurity firm CertiK recommended that crypto exchanges set hard dollar limits on the assets they hold in hot wallets, rather than judging security only by the share of funds kept in cold storage, Cointelegraph reported on November 10, 2026.
The recommendation followed disclosures by several exchanges of how much they hold offline, which the report describes as an effort to reassure customers after a record hack at Binance that targeted its hot wallets. Gate reported that 88.26% of its total assets were in cold storage. Coinbase said it keeps more than 99% of customer assets offline.
"Cold storage is a useful measure of online exposure, but it is not a standalone security score," CertiK's research team told Cointelegraph. The firm said higher cold-storage levels generally reduce online exposure, but the benefit becomes less significant at very high levels.
CertiK said rigid storage ratios could also slow withdrawals, force rushed transfers and concentrate risk in key-management systems. It recommended that exchanges set hot-wallet caps for each asset and blockchain according to the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling based on the exchange's financial resources and recovery capabilities. "Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss," the firm said.
Several jurisdictions already set cold-storage minimums. South Korea requires crypto service providers to keep at least 80% of customers' crypto assets by value in cold storage, Singapore's guidelines call for at least 90%, Japan's framework requires at least 95% and Hong Kong's baseline for licensed crypto trading platforms is 98%.