Exchanges tout cold storage ratios after $6.36B Binance hot wallet attack

By Elena Vasquez

Crypto exchanges are publishing their cold storage ratios after attackers drained approximately $6.36 billion from Binance's hot wallet infrastructure last week, according to blockchain analytics firm TRM Labs, which reported that most of the funds moved in roughly 20 minutes. The disclosures came within days, and each platform offered a different framing of the same question: how much customer money sits offline.

Binance CEO Richard Teng said the "vast majority" of user assets are held in cold wallets. The company has not provided a precise split between hot and cold holdings, a gap that leaves the claim untestable. That omission is precisely what competitors rushed to fill.

What did each exchange disclose?

The published figures cluster high, but they measure different things.

• Coinbase said in a Wednesday blog post that more than 99% of customer assets are held in offline cold storage, with excess assets continuously rebalanced into cold wallets. It acknowledged the motivation directly: "Binance's reported hot wallet incident has understandably left customers asking how Coinbase protects customer assets from something similar happening here."
• Gate launched a "Proof of Security" framework, reporting 88.26% of total assets in cold storage and 11.74% in hot wallets. The exchange claims its cold storage could cover 104.58% of customer assets even if hot wallets were fully drained. A third-party audit firm is still reviewing the data, according to Gate itself.
• Upbit, South Korea's largest exchange, confirmed on Tuesday that 99.17% of assets sit in cold wallets, with 0.83% in hot wallets as of September 2026. Those figures are already reported to the Financial Supervisory Service.
• OKX, in a security overview last updated Sept. 18, 2026, said it holds more than 95% of client crypto assets in cold wallets and under 5% in hot wallets.

The numbers are large in context. A 99% offline ratio means that for every 100 units of customer assets, only one unit is exposed to internet-connected infrastructure at any given time.

Why do the South Korean figures matter?

Upbit's disclosure responds to a domestic regulatory push. A spokesperson for parent company Dunamu said the ratio "represents the highest cold wallet storage ratio among South Korea's five major KRW-based cryptocurrency exchanges and is substantially above the regulatory minimum of 80%."

The spokesperson added: "Our aim is to keep our hot wallet holdings at an absolute minimum, with a target of maintaining them below 1% of customer digital assets."

Financial Supervisory Service figures cited in earlier reporting show the spread among Upbit's domestic peers: Bithumb at 94.76%, Coinone at 85%, Digital X, formerly Korbit, at 82.79%, and GOPAX at 80.54% at the end of September. GOPAX sits only fractionally above the 80% regulatory floor, roughly one-fifth of the cushion Upbit reports.

Are these ratios comparable?

Not reliably. Exchanges use different reporting periods and may calculate cold-storage shares against different asset bases, which means a higher headline number does not guarantee stronger protection. Gate's 88.26% and Coinbase's 99% may describe differently constructed denominators. Neither platform has published a standardized methodology, and Gate's own figures remain subject to an audit that is not yet complete.

Does cold storage actually prevent theft?

Only partially, and regulators have said so. Offline wallets can still be exposed through compromised signing systems, inadequate access controls, or employees approving fraudulent transactions. Hong Kong's Securities and Futures Commission warned in an August 2025 circular that such weaknesses could compromise both hot- and cold-wallet infrastructure simultaneously.

In plain terms: a ratio tells you where keys are stored, not whether the humans and systems that move those keys can be trusted.

What happens next?

Gate's third-party audit of its PoSEC framework is pending, and Binance has yet to disclose a precise hot-to-cold split. South Korean regulators are pressing exchanges toward higher ratios, with the 80% floor already binding and Upbit signaling a sub-1% hot wallet target. Whether other jurisdictions follow with standardized custody disclosure rules will determine whether these announcements become verifiable practice or remain marketing. For now, every number published this week is self-reported.

Related reporting notes that the U.S. Federal Reserve and the Office of the Comptroller of the Currency have begun checking American banks' crypto exposure after the Binance hack, as experts flag broader security risks.