Cybersecurity firm CertiK has called on crypto exchanges to adopt hard dollar caps on their hot‑wallet holdings, arguing that relying exclusively on cold‑storage ratios does not provide a complete security picture. The recommendation follows a wave of disclosures by exchanges about their cold‑storage percentages after Binance suffered a record‑breaking hack that targeted its hot wallets. CertiK’s research team outlined a framework for setting asset‑specific limits based on customer liabilities, expected withdrawal volumes, and an absolute loss ceiling tied to each exchange’s financial capacity.

Cold‑storage ratios under scrutiny

Gate.io disclosed that 88.26% of its total assets are stored offline, while Coinbase reported keeping more than 99% of customer assets in cold storage. Both figures were highlighted as reassurance measures after the Binance incident, but CertiK warned that high cold‑storage percentages alone do not eliminate risk. The firm noted that the marginal security benefit diminishes at very high storage levels and that excessive reliance on cold storage can slow withdrawals and concentrate risk in key‑management systems.

Regulatory benchmarks across Asia

South Korea mandates that crypto service providers retain at least 80% of customer assets by value in cold storage, Singapore’s guidelines set a 90% floor, Japan requires 95%, and Hong Kong’s baseline for licensed platforms is 98%. CertiK pointed out that while these standards aim to limit online exposure, they do not address the potential loss from hot‑wallet breaches, prompting the call for explicit dollar caps.

Proposed hot‑wallet cap framework

According to CertiK, exchanges should establish caps for each asset and blockchain using the strictest of three criteria: a percentage of total customer liabilities, an estimate of daily withdrawal needs, and an absolute loss ceiling reflecting the exchange’s liquidity and recovery capabilities. The firm suggested that flexibility in these limits can support operational liquidity, while hard dollar ceilings and circuit‑breaker mechanisms would restrict potential losses in the event of a breach.

What to watch next

Analysts will monitor how major exchanges respond to CertiK’s recommendations, especially whether Binance, Gate.io, and Coinbase will publish revised hot‑wallet policies. Regulatory bodies in the regions mentioned may also consider incorporating explicit hot‑wallet limits into future guidance. Additionally, the ongoing investigation into the Binance hack’s aftermath, including reports of North Korea‑linked actors using memecoins on NEAR to launder stolen funds, could influence broader industry security standards.