CertiK Urges Hard Dollar Caps for Crypto Exchange Hot Wallets
Cybersecurity firm argues cold storage ratios are insufficient for modern exchange security protocols.
1Security Paradigm Shift
Cybersecurity firm CertiK is challenging the industry reliance on cold-storage ratios as the primary security metric for crypto exchanges. Following the recent $6.3 billion Binance hack, the firm argues that cold storage is not a standalone security score. They advocate for implementing hard dollar caps on hot-wallet holdings to better manage risks.
2Current Regulatory Landscape
Global regulators currently mandate varying levels of cold storage for crypto service providers. South Korea requires at least 80% of assets to be held offline, while Singapore mandates 90%. Japan and Hong Kong maintain stricter frameworks at 95% and 98% respectively. CertiK suggests these high ratios may provide diminishing returns for actual security.
3Risks of Rigid Ratios
CertiK warns that relying solely on rigid storage percentages can inadvertently create new operational vulnerabilities. These requirements may slow down customer withdrawals, force exchanges into rushed asset transfers, and concentrate systemic risk within key-management systems. The firm emphasizes that flexibility is essential to maintain necessary operating liquidity during periods of high market volatility.
4Proposed Security Framework
The firm recommends that exchanges set hot-wallet caps based on three specific criteria: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling. This ceiling should be determined by the exchange’s total financial resources and recovery capabilities. These measures aim to provide a more robust defense against potential platform-wide breaches.
5Binance Recovery Efforts
Following the massive $6.3 billion hack, Binance reported that it has successfully replenished approximately 98% of the affected tokens. The exchange has committed to absorbing the losses internally. Remaining tokens are described as less liquid, meaning the final stages of the recovery process will require more time to complete for the platform.
6Laundering Through Memecoins
Investigations by Elliptic reveal that hackers linked to North Korea are utilizing memecoins to launder stolen funds. Approximately $430,000 has been traced through six newly launched tokens on the NEAR blockchain. These liquidity pools are being used to obscure the movement of assets, although the transactions remain visible and traceable on the public ledger.
7Operational Liquidity Balance
CertiK stresses that security measures must not cripple the fundamental utility of an exchange. By combining hard dollar ceilings with automated circuit breakers, platforms can limit potential losses while still supporting daily operations. This balanced approach is intended to replace the current, less effective reliance on simple, high-percentage cold storage mandates alone.
8Industry Security Outlook
As exchanges like Gate and Coinbase report high percentages of offline assets, the debate over security metrics intensifies. The industry must move beyond simple storage ratios to address the sophisticated nature of modern cyber threats. Future security protocols will likely focus on granular, asset-specific limits to ensure better protection for global user funds.