CertiK Urges Crypto Exchanges to Set Hard Dollar Limits on Hot Wallets

Cryptocurrency exchanges are increasingly using “cold storage ratios” — the share of assets held offline — to signal how well they manage theft risk. But according to cybersecurity firm CertiK, those percentages should not be treated as a complete security score on their own. Instead, exchanges should use hard dollar limits on hot-wallet holdings, paired with mechanisms that can limit losses if keys or operational processes are compromised.

The push for more concrete safeguards comes after multiple exchanges highlighted their cold-storage practices following the record Binance hack, which targeted hot wallets. Gate reported that 88.26% of its total assets were held in cold storage, while Coinbase said it keeps more than 99% of customer assets offline.

Key takeaways

CertiK argues that cold-storage ratios measure online exposure but can’t fully represent an exchange’s security posture. Instead of relying only on percentages, CertiK recommends setting hot-wallet caps in dollar terms to bound potential losses. CertiK cautions that overly rigid storage ratios may create operational problems, including slower withdrawals and rushed transfers during stress. Hot-wallet limits should be calculated using multiple constraints: customer liabilities, expected withdrawal needs, and an absolute loss ceiling tied to the exchange’s recovery capacity. Regulators in Asia already require high cold-storage percentages, but the CertiK guidance suggests exchanges need more than compliance with those thresholds.

Why cold-storage ratios aren’t enough

CertiK told Cointelegraph that cold storage is a helpful indicator of online exposure, because assets stored offline are harder to reach in real time. However, the firm warned that the ratio alone does not capture the real-world risk of loss events, which can be driven by how hot wallets are managed day to day, how quickly funds can be moved, and how much damage a compromise could cause.

This matters because hacks typically succeed through operational and key-management weaknesses. When an attacker compromises systems that can trigger transactions from hot wallets, the relevant question becomes less about the share of funds stored offline, and more about how much value is allowed to remain reachable during normal operations.

CertiK also said the marginal security improvement from increasing cold storage can diminish at very high levels. In other words, once an exchange already keeps most assets offline, the remaining online portion — even if small by percentage — can become the center of the risk analysis.

Regulatory requirements vs. risk limits

Different jurisdictions already impose minimum cold-storage thresholds for crypto service providers. South Korea requires at least 80% of customer assets by value to be kept in cold storage. Singapore’s framework calls for at least 90%, while Japan requires 95%. Hong Kong’s baseline for licensed crypto trading platforms is 98%.

CertiK’s argument does not contradict these rules; rather, it suggests that meeting regulatory minimums should not be mistaken for “best possible security.” High required ratios may reduce online exposure, but exchanges still need to manage what stays online with precise controls.

For investors and traders, the practical takeaway is that compliance reports and public cold-storage disclosures may not fully answer how much of an exchange’s liquidity is exposed at any given moment, especially under fast-moving conditions such as withdrawal spikes.

CertiK’s proposed approach: dollar caps and circuit breakers

CertiK recommended that exchanges impose hot-wallet caps for each asset and blockchain. Crucially, the limits should be derived from three constraints, with the strictest one applied:

A cap based on customer liabilities: limiting hot funds to the minimum required exposure relative to what customers may demand. An estimate of withdrawal needs: ensuring operational liquidity while acknowledging expected user outflows. An absolute loss ceiling: defining the maximum acceptable loss based on the exchange’s financial resources and recovery capabilities.

CertiK framed the goal as balancing operating liquidity with pre-defined boundaries for potential damage. “Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the firm said.

Beyond risk containment, CertiK warned that rigid storage ratios could introduce operational friction. In worst-case scenarios, such friction can translate into slower withdrawals, hurried internal transfers, and a higher chance that incident response depends heavily on a small number of key-management systems.

Binance recovery updates and laundering attempts

While CertiK’s guidance focuses on how exchanges should structure controls, public disclosures from exchanges continue to shape customer perception after major incidents. Last week, Binance said it had replenished about 98% of the tokens affected by the hack and would absorb the remaining losses. In a follow-up recovery update on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.

At the same time, external investigators have pointed to attempts to obscure stolen funds. Elliptic reported that North Korea-linked hackers created memecoins allegedly used to launder funds from the theft. The firm traced roughly $430,000 across six newly launched tokens on NEAR, citing liquidity pools that helped obscure transfers between wallets, while still remaining traceable on-chain.

Together, these developments highlight why exchanges and regulators should focus not only on how assets are stored, but on how quickly an exchange can restore liquidity and how attackers may adapt their tactics after an incident.

As more exchanges publish cold-storage figures, the next question for users and compliance teams is whether those disclosures are accompanied by practical, enforceable hot-wallet limits—especially dollar-based caps tied to liabilities, withdrawal expectations, and realistic recovery ceilings. The industry’s challenge will be implementing safeguards that reduce loss without impairing withdrawal access when it matters most.

This article was originally published as CertiK Urges Crypto Exchanges to Set Hard Dollar Limits on Hot Wallets on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.