CertiK Says Crypto Exchanges Need Hard Dollar Caps on Hot Wallets

Digital asset platforms should establish strict financial limits on internet-connected storage rather than depending solely on offline percentages to evaluate overall platform security, according to the cybersecurity firm CertiK. The recommendation emerges as several platforms recently published their offline storage figures to reassure users following a significant digital asset breach that targeted online funds.

Following the major security incident involving Binance, several operators reported their offline asset distributions. Gate announced that a large portion of its total assets remained offline, while Coinbase stated it keeps the vast majority of customer holdings in offline environments. CertiK researchers noted that while maintaining offline reserves reduces internet exposure, the protective benefits diminish significantly at extreme percentages.

Several jurisdictions enforce specific minimum offline storage rules. South Korea mandates that virtual asset service providers keep a high percentage of customer funds by value offline. Similar regulatory frameworks exist in Singapore, Japan, and Hong Kong, establishing baseline offline requirements for licensed digital asset platforms. Despite these rules, CertiK cautioned that rigid storage ratios could potentially slow down customer withdrawals, create hurried transfer procedures, and concentrate operational risk within key-management architectures.

Strict dollar limits and operational circuit breakers help restrict potential financial losses during security incidents.

To address these risks, the cybersecurity firm suggested that trading platforms should evaluate hot-wallet caps for every specific asset and blockchain. These thresholds should reflect a percentage of customer liabilities, projected withdrawal demands, and a definitive loss ceiling based on the operational resources and recovery capacity of the enterprise. Meanwhile, platforms like Binance reported progress in replenishing affected tokens following recent security challenges, absorbing the associated losses while addressing remaining less liquid assets.

Concurrently, illicit actors have utilized newly launched tokens to obscure transferred funds following digital asset thefts. Investigations by Elliptic revealed that specific tokens deployed on alternative networks helped obfuscate transfer paths between wallets, although the transactions remained visible on the public ledger.

Why it matters

These recommendations highlight the evolving security standards for digital asset platforms globally, influencing how exchanges balance operational liquidity with risk management. For participants in the broader financial ecosystem, understanding these security frameworks is essential when evaluating the safety of stored digital holdings across different jurisdictions.