Original report published by Cointelegraph on November 10, 2026, at 13:05:58 UTC+08:00. This article reflects that reporting context.
Crypto exchanges’ cold-storage disclosures can indicate how much they keep offline, but they do not establish how much an exchange could lose in a hot-wallet breach. That was the distinction cybersecurity firm CertiK drew in comments to Cointelegraph following what the report described as a record Binance hack targeting its hot wallets.
CertiK recommended hard dollar limits on hot-wallet holdings rather than relying solely on the percentage of assets held offline.
The reassurance—and its limits
Exchanges had disclosed cold-storage figures in an effort to reassure customers after the attack. Gate reported holding 88.26% of its total assets in cold storage, while Coinbase said it keeps more than 99% of customer assets offline. The disclosures refer to different asset bases: total assets for Gate and customer assets for Coinbase.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.
The report also outlined cold-storage requirements and guidelines across jurisdictions:
- South Korea: At least 80% of customers’ crypto assets by value.
- Singapore: Guidelines call for at least 90%.
- Japan: Its framework requires at least 95%.
- Hong Kong: A 98% baseline for licensed crypto trading platforms.
According to CertiK, higher cold-storage levels generally reduce online exposure, but the incremental benefit becomes smaller at very high levels. Rigid ratios could also slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
The evidence gap in a reassuring storage percentage is therefore the remaining exposure: the ratio alone does not establish a maximum potential dollar loss.
CertiK’s proposed loss limits
CertiK said exchanges should set hot-wallet caps for each asset and blockchain using the strictest of three limits:
- A percentage of customer liabilities.
- Estimated withdrawal needs.
- An absolute loss ceiling tied to the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the research team said.
This was a security recommendation, not evidence that exchanges had implemented those controls.
Binance’s recovery claims and the laundering trail
In the week preceding the original report, Binance said it had replenished approximately 98% of affected tokens and would absorb the losses. In a recovery update described in the source as occurring on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.
Separately, blockchain analytics firm Elliptic said North Korea-linked hackers had created memecoins to launder funds from the theft. Elliptic traced roughly $430,000 through six newly launched tokens on NEAR. According to the firm, liquidity pools helped obscure transfers between wallets, although the transactions remained traceable onchain.