If you keep assets on an exchange, the everyday concern is whether a withdrawal can clear when you need it, and how much of the balance an online compromise could reach. Hot wallets exist for that accessibility. Cold storage keeps a larger share offline. Those are different jobs, and a high offline percentage does not by itself describe key confidentiality or whether recovery arrangements are redundant.
ChainCatcher reported on November 10, 2026 (13:18, UTC+8) that cybersecurity firm CertiK recommended exchanges set hard U.S. dollar ceilings on hot-wallet holdings, rather than treating a cold-storage ratio as the measure of security. The suggestion was reported as exchanges had been disclosing cold-wallet shares to reassure customers after a record hot-wallet hack at Binance.
Gate reported that 88.26% of its total assets were held in cold storage. Coinbase said more than 99% of customer assets were stored offline.
CertiK’s research team told Cointelegraph that cold storage is a useful indicator of online risk exposure, but not an independent security score. Reported policy floors differ by place: South Korea requires crypto service providers to keep at least 80% of the value of customer crypto assets in cold storage; Singapore’s guidance requires at least 90%; Japan’s framework requires at least 95%; and the benchmark for licensed crypto trading platforms in Hong Kong is 98%.
CertiK said higher cold-storage levels usually reduce online exposure, with diminishing benefit at very high levels. It also said a rigid storage ratio can slow withdrawals, force hurried transfers, and concentrate risk in the key-management system.
The firm’s suggested rule is to set the hot-wallet cap for each asset and blockchain at the strictest of three limits: a percentage of customer liabilities, estimated withdrawal demand, and an absolute loss ceiling based on the exchange’s financial resources and recovery capacity.
Binance said the previous week that, after the hack, it had replenished about 98% of the affected tokens and had borne the loss itself. It said the remaining tokens were less liquid and would take longer to obtain. Separately, Elliptic said hackers linked to North Korea laundered funds by issuing memecoins, moving about $430,000 through six newly issued tokens on NEAR. These are attributed claims as carried in the report, not independently confirmed loss totals.
A published cold-storage share is one check on how much is described as offline. It is not evidence that hot-wallet exposure, key management, or the ability to restore balances are adequate, and no custody setup removes loss risk.
Original article: ChainCatcher, published November 10, 2026, 13:18 (UTC+8).
