CertiK Urges Exchanges to Set Limits on Hot Wallets

Cybersecurity company CertiK recommended that cryptocurrency exchanges set strict limits on the dollar value of assets held in hot wallets. According to researchers, a high proportion of funds in cold storage alone does not allow for an assessment of the trading platform's security.

The recommendations came in the wake of the Binance hack on October 29, 2026, which affected crypto assets worth approximately $6.34 billion. Following the incident, several major exchanges disclosed data on the distribution of reserves between hot and cold wallets.

Cryptocurrency exchange Gate reported that as of November 4, 88.26% of its total assets were in cold storage, while 11.74% were in hot wallets. Meanwhile, Coinbase stated that it holds more than 99% of client assets offline.

Hot wallets are connected to the network and are used for processing current operations, including cryptocurrency withdrawals. Cold wallets are isolated from the internet, reducing the likelihood of remote access by attackers, but do not eliminate risks associated with key management and fund transfers.

CertiK proposed calculating limits based on 3 criteria

According to CertiK, cryptocurrency exchanges should determine the maximum value of assets in hot wallets separately for each cryptocurrency and blockchain.

The company suggests considering 3 indicators: the share of liabilities to clients, the estimated need for funds for withdrawals, and the absolute limit of possible losses that the exchange can cover considering financial resources and recovery capabilities.

The final restriction should correspond to the strictest of these criteria. Additionally, researchers recommend using automatic mechanisms to suspend operations when suspicious activity is detected.

CertiK also notes that excessively strict requirements for the share of cold storage can slow down cryptocurrency withdrawals, force exchanges to urgently move funds, and increase risks in key management systems.

Regulators in different countries set their own guidelines. In South Korea, cryptocurrency service providers must keep at least 80% of client virtual assets in cold wallets. In Singapore, recommendations provide for at least 90%, in Japan, the standard is 95%, and for licensed trading platforms in Hong Kong, the figure is 98%.

Binance announced the replenishment of 98% of assets after the hack

On November 4, Binance announced that it had replenished about 98% of the assets affected by the cyberattack. The exchange stated its intention to cover the losses with its own funds. Acquiring the remaining assets requires additional time due to their limited liquidity.

However, replenishing reserves does not mean the return of stolen cryptocurrencies from the attackers.

Analytical company Elliptic also reported the discovery of a scheme to move part of the stolen funds through the NEAR blockchain. According to its researchers, participants linked to North Korea created 6 new memecoins and used liquidity pools to move about 117,000 NEAR worth approximately $430,000.

This scheme allowed funds to be transferred between different groups of wallets without direct transactions between them. However, the operations remained traceable on the blockchain.

CertiK's recommendations do not establish new mandatory standards for cryptocurrency exchanges. They propose supplementing existing storage rules with quantitative limits that will allow for the pre-determination of the maximum allowable size of funds at risk in the event of hot wallet compromise.