Security firm CertiK urges absolute dollar limits for exchange hot wallets
Following the massive $6.3 billion Binance security breach, CertiK recommends cryptocurrency exchanges establish absolute dollar caps for hot wallet storage instead of depending exclusively on cold storage percentage ratios.
Cryptocurrency trading platforms ought to establish firm dollar-based restrictions on the amount they hold in hot wallets instead of depending exclusively on cold-storage percentage ratios as a security benchmark, cybersecurity company CertiK has stated.
This guidance emerged after multiple cryptocurrency trading platforms recently made public their cold wallet storage percentages in an effort to restore user confidence following the unprecedented Binance security breach that compromised its hot wallet infrastructure. Trading platform Gate revealed that cold storage accounts for 88.26% of its aggregate asset holdings, whereas Coinbase disclosed that it maintains in excess of 99% of client assets in offline storage.
Cold storage is a useful measure of online exposure, but it is not a standalone security score
CertiK's research team
Regulatory frameworks in South Korea mandate that cryptocurrency service providers maintain a minimum of 80% of customers' digital asset holdings by value in cold storage facilities. Singapore's regulatory guidance stipulates a minimum threshold of at least 90%, whereas Japan's regulatory framework mandates at least 95% and Hong Kong's baseline requirement for licensed cryptocurrency trading platforms stands at 98%.
According to CertiK's analysis, although elevated cold-storage percentages typically diminish online risk exposure, the incremental security advantage becomes progressively less meaningful when approaching very high threshold levels.
Inflexible storage percentage requirements could additionally impede withdrawal processing speeds, necessitate hasty asset transfers and create concentrated vulnerabilities within key-management infrastructure systems.
CertiK recommended that cryptocurrency exchanges ought to evaluate implementing hot-wallet maximum thresholds for individual assets and blockchain networks based on whichever is most restrictive among three limiting factors: a percentage relative to customer liability obligations, projected withdrawal demand estimates and an absolute maximum loss threshold determined by the exchange's financial reserve capacity and asset recovery capabilities.
Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss
CertiK
Binance says it has replaced 98% of affected assets
Binance announced last week that it had successfully restored approximately 98% of the tokens impacted by the security breach and confirmed the exchange would assume responsibility for the losses. In an updated recovery statement released on Wednesday, the trading platform indicated that the outstanding tokens possessed lower liquidity profiles and would require additional time for procurement.
In related developments, threat actors with connections to North Korea have deployed memecoins as a mechanism to launder proceeds from the theft, according to findings from Elliptic. The blockchain intelligence firm successfully traced approximately $430,000 moving through six recently created tokens on the NEAR protocol, where liquidity pool mechanisms facilitated the obfuscation of transfers between wallet addresses, although the transaction flows remained visible and traceable on the blockchain.