CertiK Tells Exchanges to Cap Hot Wallets in Dollars After $6.34B Binance Hack

Blockchain security firm CertiK is urging crypto exchanges to set hard dollar limits on hot wallet holdings, arguing that cold-storage percentages — the metric rivals have been publishing since the record Binance hack — don't tell users how safe their funds actually are.

The recommendation lands weeks after attackers breached Binance's internal wallet-signing service on October 29, 2026, and drained approximately $6.34 billion from its hot wallets across 10 chains. CertiK's dashboard recorded roughly $6.39 billion in total losses for October 2026, with the Binance incident as the primary contributor.

"Cold storage is a useful measure of online exposure, but it is not a standalone security score," CertiK told Cointelegraph.

Why ratios mislead

A hot wallet stays connected to the internet so an exchange can process withdrawals quickly; a cold wallet sits offline, harder to reach and harder to steal from. Exchanges need that online cash drawer. According to Fireblocks, exchanges typically keep only enough in hot wallets to cover a few days of withdrawals.

The problem, CertiK says, is how the drawer gets measured. A cold-storage ratio tells you what share of assets sits offline, but says nothing about the actual dollar amount exposed online. Picture two exchanges that each keep 1% of assets in hot wallets. If one holds far more in total, its 1% is a much bigger prize. The percentages look identical; the payoff for an attacker doesn't.

A hard dollar cap fixes that blind spot. It puts a ceiling on how much an attacker could grab from the online side of the business, no matter how large the exchange grows.

What else do the percentages miss?

CertiK analyst Jonathan Riss argued that cold-to-hot percentages ignore key parts of the security picture — specifically internal controls and transaction limits, which decide how money actually moves once it sits in a hot wallet. Those operational details determine whether a breach becomes a $100 million event or a multi-billion-dollar one.

How the industry responded to the Binance breach

After the October incident, rival exchanges rushed to publish their cold-storage ratios to reassure customers:

• Coinbase disclosed that it keeps over 99% of assets in cold storage.
• South Korea's Upbit reported 99.17% in cold storage.
• Gate came in at 88.26% cold-storage coverage.

Gate went a step further, rolling out a "Proof of Security" framework after the incident.

Regulators are moving too. Authorities in South Korea have called for stringent cold-storage minimums. But that approach still centers on ratios — exactly the metric CertiK says can't carry the full weight of a security assessment. A minimum percentage can work as a floor, but it doesn't cap the absolute dollars at risk.

What would a dollar cap cost?

For users, the takeaway is to read cold-storage disclosures with skepticism. The questions that matter more are operational: how transactions get approved, who can move money out of hot wallets, and whether limits exist on single transfers. Riss's point about internal controls and transaction limits gets at precisely these issues.

For exchanges, a dollar cap carries real trade-offs. Keeping less online means refilling hot wallets more often from cold storage, which takes time and adds steps to the process. During periods of heavy withdrawals, a tight cap could slow payouts — a competitive risk in a market where withdrawal speed is a selling point.

With South Korean regulators pushing cold-storage mandates and exchanges now competing on security disclosures, the industry faces a choice in the coming months: keep marketing ratios, or adopt absolute caps that actually bound the worst-case loss.