CertiK Wants a Hard Cap on Hot Wallets. The Real Number Exchanges Won't Say Out Loud Is 5%

I've gotten into a habit that probably makes me bad company at conferences. Whenever an exchange publishes a security update, I scroll past the cold storage diagram and look for one number: how much of the customer float is sitting on a hot wallet right now.

Nobody answers that. Which is the whole problem.

So when CertiK came out arguing that exchanges need hard dollar caps on hot wallets, my first reaction was, finally, someone's pointing at the actual weak spot instead of waving a picture of a vault. My second reaction was more measured. A fixed dollar cap is the wrong shape of a rule, and I'm not entirely convinced a number published on a blog post changes behavior at 3am on a Sunday when a withdrawal queue is piling up.

But the firm's underlying point deserves more attention than it'll probably get. Cold storage is an exposure metric. It isn't a security score. Those are different things, and conflating them has cost people a lot of money.

What a hot wallet actually is

Here's the mechanic most outlets skip. A hot wallet is any address where the private keys live on a machine connected to the internet. Exchanges need one, or several, because withdrawals have to clear in seconds, and you can't sign every $200 withdrawal from an air-gapped laptop in a basement without customers screaming.

So the standard practice is to keep a small slice of total assets liquid and push the rest to cold storage. The slice varies wildly. I've heard operators describe figures anywhere from under 1% to double digits depending on chain, asset and how much they trust their own monitoring. Call it 3% to 5% as a rough industry habit and you won't be far off.

Now do the arithmetic. An exchange holding $10 billion in customer assets with 5% hot is $500 million behind a key that lives on a server with an internet connection. Not $500 million in a vault with guards and a time lock. An internet-connected key. If that key leaks, the money is gone in minutes and it doesn't come back.

February 21, 2025 is the date to keep in your head. Roughly $1.5 billion in ETH and related tokens walked out of Bybit in a single afternoon, the largest crypto theft on record, and the FBI pinned it on North Korea's Lazarus Group within days. That wasn't a cold storage failure. Cold storage held. The lesson people keep misreading is that the hot slice doesn't need to be big to be catastrophic. It just needs to be reachable.

The question worth asking: if a 5% hot slice can vaporize a mid-sized exchange's entire equity cushion, why is the industry's disclosure standard a screenshot of an offline laptop?

Cold storage isn't a score

This is where CertiK's framing gets sharper than it first looks. Security ratings, the little letter grades exchanges love to display, tend to reward the presence of cold storage and audit reports. But a rating that measures how much of your stack is offline tells you nothing about key ceremonies, signer quorum, withdrawal velocity limits, or whether one engineer can approve a $50 million transfer alone at midnight.

Cold storage is a proxy forhow much is online. It's not a proxy forhow well you control what's online. Those are separate questions and only one of them keeps getting asked.

Zoom out and the market implications split cleanly. The big venues, Coinbase, Kraken, Binance, Bitfinex, can absorb this kind of constraint. They've already got tiered custody, insurance arrangements, multi-party approval flows and the legal budget to document all of it. A hard cap is a compliance line item for them. Annoying, survivable.

Smaller exchanges get squeezed. A fixed dollar cap hits a venue with $300 million in assets and a venue with $30 billion in assets equally, which is absurd on its face. For the small operator, the choice becomes spend on custody engineering or stop promising instant withdrawals. Most will quietly do the second, and their customers won't find out until the first stressful week.

And that's the tension nobody in this debate wants to name out loud. Instant, 24/7 withdrawals are a product feature that people have come to expect. They exist because someone is holding a pile of liquid coins online. Tighten the hot wallet and you tighten withdrawal throughput. In a panic, a withdrawal queue is the thing that turns a bad afternoon into a bank run.

History suggests otherwise on one count, though. Every major collapse I can name in this industry has been a liabilities problem dressed up as a custody problem. Proof of reserves that shows assets and skips liabilities is theater. A hot wallet cap without a matching disclosure of what's owed to customers is a padlock on the wrong door.

What I'd actually do with this

If I were writing the rule, I wouldn't write a dollar cap. I'd write a percentage ceiling tied to total customer assets, something in the low single digits, plus an absolute ceiling that scales by tier. Under $1 billion in assets, cap it at a few percent. Above $10 billion, the percentage tightens because the numbers get too big to be casual about.

Then I'd bolt on the parts that actually prevent the Bybit-style outcome. Outflow velocity limits that trip an automatic freeze above a set threshold. Mandatory disclosure of signer quorum. Insurance or a funded backstop sized to the hot slice, not to the balance sheet. And a public number, updated weekly, for hot wallet share of total assets. Not a letter grade. A number.

Color me skeptical, but I don't expect exchanges to volunteer that. The incentive runs the other way. Instant withdrawals win customers, and the risk sits in a tail event most users will never personally see.

So here's the practical version for anyone with money on an exchange right now, which is most of you. Stop treating the cold storage diagram as a safety certificate. Ask support how much of total assets sits in hot wallets and how fast outflows can be, and see whether you get a real answer or a link to a blog post. The venues that answer clearly are the ones that have thought about this. The ones that send you marketing copy haven't, or won't say.

CertiK's instinct is right. The specific prescription is clumsier than the diagnosis, and a hard dollar cap will probably get negotiated into something softer within a year.

Time will tell, though. What I do know is that the number matters more than the diagram, and the industry has spent a decade hoping nobody asks for it.