For holders keeping crypto on an exchange, a high cold-storage percentage tells only part of the security story. Cybersecurity firm CertiK argues that exchanges should also set hard dollar limits on hot-wallet holdings, rather than relying solely on the share of assets stored offline.
Cointelegraph’s original report, published November 10, 2026, at 13:05:58 UTC+8, outlined the recommendation following a record Binance hack targeting its hot wallets.
Offline storage is one measure, not a security score
Several exchanges disclosed their cold-storage holdings to reassure customers after the hack. Gate reported holding 88.26% of its total assets in cold storage, while Coinbase said it keeps more than 99% of customer assets offline. Those disclosures use different descriptions of the assets being measured: total assets for Gate and customer assets for Coinbase.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.
The report also outlined cold-storage requirements and guidelines across several jurisdictions:
- South Korea: Crypto service providers must keep at least 80% of customers’ crypto assets by value in cold storage.
- Singapore: Guidelines call for at least 90%.
- Japan: The framework requires at least 95%.
- Hong Kong: The baseline for licensed crypto trading platforms is 98%.
According to CertiK, higher cold-storage levels generally reduce online exposure, but the additional benefit becomes less significant at very high levels. Rigid ratios can also slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
How CertiK proposes limiting hot-wallet exposure
CertiK recommended setting hot-wallet caps for each asset and blockchain using the strictest of three limits:
- A percentage of customer liabilities.
- Estimated withdrawal needs.
- An absolute loss ceiling based on the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the research team said.
For holders assessing an exchange’s custody disclosures, the distinction is between how much is offline and how much could remain exposed online. CertiK’s proposal addresses both the need to process withdrawals and the need to constrain potential losses; a cold-storage percentage alone does not answer both questions.
Binance recovery and tracing claims at the time
The report said Binance had announced the previous week that it had replenished approximately 98% of affected tokens and would absorb the losses. In a recovery update described as taking place on Wednesday, Binance said the remaining tokens were less liquid and would take longer to acquire. Replenishing affected tokens is distinct from recovering stolen funds.
Separately, blockchain analytics firm Elliptic said North Korea-linked hackers had created memecoins to launder funds from the theft. Elliptic traced roughly $430,000 through six newly launched tokens on NEAR. According to the firm, liquidity pools helped obscure transfers between wallets, although the transactions remained traceable onchain.
These recovery and tracing statements reflect the November 2026 report, not a current status update.