CertiK Tells Exchanges to Cap Hot Wallets in Dollars, Not Ratios

CertiK says crypto exchanges should impose hard dollar ceilings on hot-wallet holdings instead of relying on cold-storage ratios alone. The recommendation landed days after the record $6.3 billion hack of Binance's hot wallets pushed rival platforms to publish their own storage splits.

Gate reported that 88.26% of its total assets sit in cold storage. Coinbase says it keeps more than 99% of customer assets offline. The disclosures were aimed at nervous customers. CertiK argues the numbers say less than they seem.

"Cold storage is a useful measure of online exposure, but it is not a standalone security score," CertiK's research team told Cointelegraph.

What do the regulations require?

Several jurisdictions already mandate minimum cold-storage ratios for crypto service providers:

• South Korea: at least 80% of customer crypto assets by value in cold storage
• Singapore: guidelines call for at least 90%
• Japan: framework requires at least 95%
• Hong Kong: baseline of 98% for licensed trading platforms

CertiK's point is that these thresholds miss the operational picture. Higher cold-storage levels do reduce online exposure, but the benefit flattens at very high levels. Rigid ratios carry their own costs: they can slow withdrawals, force rushed transfers between wallets, and concentrate risk inside key-management systems.

The firm's alternative is a three-part limit for each asset on each blockchain. Exchanges should set hot-wallet caps according to the strictest of:

• a percentage of customer liabilities
• estimated withdrawal needs
• an absolute loss ceiling based on the exchange's financial resources and recovery capabilities

"Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss," the researchers said.

Where does Binance's recovery stand?

Binance said last week it had replenished approximately 98% of the tokens affected by the hack and will absorb the losses itself. In a recovery update on Wednesday, the exchange said the remaining tokens are less liquid and will take longer to acquire.

The stolen funds are already moving. Blockchain analytics firm Elliptic traced roughly $430,000 laundered through six newly launched memecoins on NEAR, a tactic linked to North Korea-affiliated hackers. Liquidity pools helped obscure transfers between wallets, though Elliptic noted the transactions remained traceable on-chain.

What does this change for exchanges?

If CertiK's framework gains traction, cold-storage percentages stop being the headline security metric. Exchanges would instead publish loss ceilings tied to their balance sheets, and regulators would have a dollar figure to test against. That shifts the conversation from optics about offline coins to how much an exchange can genuinely afford to lose.

Analysts have so far seen no broader contagion from the $6.3 billion theft, but the memecoin laundering on NEAR suggests recovery and tracing efforts will run for months as exchanges and analytics firms chase the remaining funds.