Gate Launches PoSEC, a Cold-Storage Stress Test for Exchanges

Gate launched a Proof of Security framework, PoSEC, on November 5, 2026, and its first snapshot shows cold storage holdings at 104.58% of customer balances. The exchange, which manages over $10 billion in user assets, claims it could absorb a total loss of its hot wallets and still repay every customer in full.

The first PoSEC snapshot was taken at 00:00 UTC on November 4. It disclosed that 88.26% of user assets sit in offline cold storage, with 11.74% held in internet-connected hot wallets. Gate bills the standard as the first of its kind among digital asset trading platforms and has published the methodology so competitors can replicate it.

Gate founder and CEO Lin Han has framed the benchmark as a bar the entire industry should clear. He said an exchange should survive a total wipeout of its online wallets without customers taking a hit.

Why the timing matters

The launch came one week after attackers pulled approximately $6.34 billion from Binance's hot wallets on October 29, 2026. The theft, attributed to a group linked to North Korea, has been described as a highly coordinated operation and the largest recorded theft in crypto history.

That incident is precisely the scenario PoSEC measures. Hot wallets process withdrawals quickly because they stay online, and that same connectivity makes them the primary attack surface. A reserve snapshot proves the money exists; it says nothing about how much of it sits within an attacker's reach.

The analogy Gate draws is a bank branch. Proof of Reserves confirms the vault holds enough cash for every depositor. Proof of Security asks whether the teller drawers could be emptied and the vault alone would still cover everyone.

How PoSEC extends an existing disclosure stack

Gate has run Proof of Reserves since 2020. Those attestations used Merkle trees, a cryptographic structure that lets each user verify their balance was included in the total without exposing other users' data. The exchange later added zk-SNARKs, a form of zero-knowledge proof, to strengthen privacy in that process. Its reserve reports have consistently shown reserves exceeding liabilities.

PoSEC extends the disclosure in two directions. It publishes the cold-to-hot storage split, and it evaluates resilience against an extreme loss event under independent audits, according to Gate.

What does Lin Han want beyond PoSEC?

The CEO expressed solidarity with Binance after the October 29 attack and used the moment to push for sector-wide change. His proposals include:

• An industry-wide security alliance to raise standards and coordinate incident responses
• A "Vault" custody system built on multi-party computation, or MPC
• Deliberate withdrawal delays paired with MPC key-splitting, giving defenders time to react before funds move

MPC splits a private key into pieces held by different parties, so no single compromised machine can move funds on its own.

What the standard cannot verify

PoSEC has clear limits. It cannot audit an exchange's internal security controls — who holds the keys, how access is logged, or whether an insider could bypass procedures. Cold storage is safer, not invincible; the metric measures where assets sit, not how well the vault door is built.

There is also an unavoidable trade-off. The more funds an exchange keeps offline, the slower withdrawals can become. Lin Han's own Vault proposal leans into that friction by design, building in withdrawal delays that users accustomed to near-instant transfers may notice.

The competitive angle cuts both ways. After a $6.34 billion theft, security disclosure has become a marketing asset, and a self-designed standard in which the designer scores well warrants scrutiny — particularly one that cannot audit the controls that matter most. Still, the core idea holds: reserve snapshots alone have repeatedly failed to protect users from hot wallet failures, and a metric that stress-tests the worst case is a credible next step.

For the framework to carry weight beyond Gate's own disclosures, rival exchanges will need to adopt the published methodology — or a third party will need to standardize it — before the next large-scale hot wallet incident tests whether the 104.58% figure holds in practice.