CertiK Urges Crypto Exchanges to Adopt Hard Dollar Caps on Hot Wallets

Cryptocurrency exchanges must establish absolute dollar caps on their hot wallets rather than depending strictly on cold-storage ratios to measure operational risk, according to cybersecurity firm CertiK ¹. The advisory follows voluntary reserve disclosures across trading venues after a historic hack hit Binance hot wallets ¹. Gate reported holding 88.26% of assets in offline reserves, while Coinbase disclosed keeping over 99% of customer holdings in cold storage ¹.

Jurisdictional mandates across Asia enforce strict offline asset baselines ¹. Regulators in South Korea require virtual asset service providers to maintain at least 80% of customer funds in cold wallets ¹. Singapore guidelines mandate a minimum of 90%, Japan demands at least 95%, and Hong Kong requires licensed platforms to hold 98% of client crypto offline ¹. However, CertiK cautioned that marginal security gains diminish at extreme cold-storage ratios ¹. Stiff quotas can introduce operational friction by delaying normal customer withdrawals, inducing hasty rebalancing transfers, and concentrating vulnerability within key-management architectures ¹.

Dollar-Based Limits and Asset Recovery

To manage exposure without compromising liquidity, CertiK recommended exchanges implement hot-wallet ceilings tailored per asset and network ¹. The firm suggested calibrating limits to the most conservative of three criteria: a set percentage of liabilities, expected withdrawal volumes, or an absolute loss threshold bounded by an exchange's balance-sheet recovery capabilities ¹. CertiK emphasized that operational flexibility must be paired with dollar ceilings and automated circuit breakers to restrict worst-case downside ¹.

The security recommendations emerge as Binance reported replacing roughly 98% of the assets drained in its recent hack, committing to absorb the shortfall directly ¹. Binance noted that recovering the final balance would require more time because of lower liquidity in the remaining token pools ¹. Separately, blockchain analytics firm Elliptic reported that North Korea-linked actors laundered about $430,000 of the stolen Binance capital by launching six memecoins on NEAR, attempting to break the transaction trail through decentralized liquidity pools ¹.