CertiK Calls for Strict Hot Wallet Limits After Binance's Record $6.3B Crypto Hack

CertiK Hot Wallet Limits Become a Priority After Binance Hack

CertiK hot wallet limits have become a major topic in cryptocurrency security after blockchain cybersecurity firm CertiK warned that exchanges should establish strict dollar-based caps on assets held in internet-connected wallets.

The recommendation follows the October 29, 2026, Binance security breach, in which attackers stole approximately $6.3 billion in digital assets.

In comments reported by Cointelegraph on November 10, CertiK's research team argued that cryptocurrency exchanges should not measure their security primarily through the percentage of customer assets stored offline.

Although cold storage reduces exposure to online attacks, it does not reveal how much money an attacker could potentially access through compromised hot-wallet infrastructure.

For example, an exchange holding 99% of its assets offline may appear extremely secure.

However, if the exchange manages $100 billion in customer assets, the remaining 1% represents $1 billion.

That amount could still create a major financial crisis if the exchange's online wallet systems were compromised.

CertiK therefore recommends a more practical approach.

Instead of focusing exclusively on the proportion of assets held in cold storage, exchanges should establish maximum dollar exposure limits based on operational needs and financial resilience.

The recommendation reflects growing concern about cryptocurrency custody as exchanges become more closely connected with traditional financial markets.

Why CertiK Wants Crypto Exchanges to Cap Hot Wallet Holdings

Hot wallets are cryptocurrency wallets connected to internet-accessible systems.

Exchanges use them to process deposits, withdrawals, and other transactions requiring relatively fast execution.

Cold wallets, by comparison, keep critical signing infrastructure offline or isolated from continuously connected environments.

Cold storage reduces the risk of certain remote attacks.

However, exchanges cannot generally keep every asset completely offline while still offering convenient withdrawals.

They need enough liquidity in operational wallets to meet customer demand.

This creates a security challenge.

Holding too much cryptocurrency online increases the amount potentially exposed to attackers.

Holding too little can slow withdrawals and create operational difficulties.

CertiK argues that exchanges need to balance these competing requirements through carefully designed financial limits.

Why Percentages Can Be Misleading

Consider three hypothetical exchanges.

These examples are illustrative, not actual exchange balances.

Exchange C has the highest cold-storage percentage alongside Exchange B.

However, its remaining online exposure could be substantially larger.

The calculation demonstrates why storage percentages alone are insufficient.

A more useful security assessment considers the maximum amount that could be lost through a compromised system.

It also examines how quickly suspicious transfers could be detected and stopped.

CertiK Recommends a Three-Factor Hot Wallet Security Framework

CertiK outlined three important factors that exchanges should use when determining appropriate hot-wallet exposure limits.

1. Percentage of Customer Liabilities

The first factor is the total amount an exchange owes to its customers.

An exchange holding large customer balances should limit the proportion exposed through online wallet infrastructure.

This helps prevent a single security incident from affecting an excessive share of customer assets.

However, the percentage must be evaluated alongside the absolute dollar amount.

A low percentage may still represent a significant financial risk for a large exchange.

2. Expected Withdrawal Demand

The second factor is the amount of cryptocurrency customers are likely to withdraw during normal operations.

Exchanges need sufficient liquidity to process legitimate withdrawals.

If hot-wallet balances are too low, customers may experience delays while funds are transferred from cold storage.

CertiK recommends that exchanges account for expected withdrawal requirements when setting operational limits.

These requirements may differ across assets and blockchain networks.

For example, Bitcoin and stablecoins may have different withdrawal patterns.

A single universal limit may therefore be inappropriate.

3. Absolute Financial Loss Ceiling

The third factor is the exchange's ability to absorb losses.

CertiK recommends setting a maximum dollar exposure based on available financial resources and recovery capabilities.

This is particularly important because an exchange may hold large customer balances without having sufficient capital to absorb a major theft.

A hard dollar cap can help prevent operational wallet exposure from growing beyond a manageable level.

The final limit should reflect the strictest applicable constraint among customer liabilities, withdrawal requirements, and financial loss tolerance.

What Are Hot Wallet Circuit Breakers?

CertiK also recommends circuit breakers as an additional security measure.

A circuit breaker is a mechanism designed to pause or restrict transactions when predefined conditions are triggered.

In traditional financial markets, circuit breakers can temporarily halt trading during extreme price movements.

In cryptocurrency custody, similar controls can restrict suspicious asset transfers.

Examples of Wallet Security Controls

An exchange could establish transaction limits that prevent a single wallet from transferring more than a specified amount during a particular period.

It could also require additional approvals for unusually large withdrawals.

Automated monitoring systems might flag unexpected transfers to newly created addresses.

If suspicious activity is detected, emergency controls could temporarily suspend affected signing services or transaction flows.

However, circuit breakers are not guaranteed to prevent every attack.

Their effectiveness depends on how they are implemented and whether attackers can bypass or compromise the controls.

A system that allows an attacker to change its own withdrawal limits may provide little protection.

Security controls therefore need independent authorization and effective access restrictions.

How Binance Lost Approximately $6.3 Billion

CertiK's recommendation follows one of the largest reported cryptocurrency thefts in history.

On October 29, attackers compromised systems connected to Binance's hot-wallet infrastructure.

The breach affected assets across multiple blockchain networks.

According to blockchain analytics company Elliptic, approximately $6.43 billion in cryptocurrency was stolen.

Binance initially estimated the impact at approximately $6.3 billion.

The difference reflects separate reporting and valuation methodologies.

Investigators have linked the attack to North Korean cyber actors.

However, the precise sequence of every compromise remains subject to investigation.

The Attack Involved More Than Private Keys

The incident highlighted an important distinction between protecting private keys and protecting the systems authorized to use them.

A cryptocurrency private key is used to authorize transactions.

However, modern institutional custody systems may use distributed signing arrangements rather than storing a complete private key in one location.

Attackers can sometimes compromise the software, permissions, or operational infrastructure responsible for requesting authorized transactions.

In those circumstances, unauthorized transfers may occur without a traditional private-key leak.

Bitnxt previously examined the breach in its report on Binance's fake job interview attack and compromised wallet-signing infrastructure.

That investigation described Binance's account of a multi-stage attack involving malicious recruitment activity, compromised developer systems, and unauthorized access to internal tools.

The incident demonstrates why custody security must protect the entire transaction authorization process.

Why the Binance Attack Exposed Weaknesses in Operational Controls

The Binance incident raised questions about how cryptocurrency exchanges manage access to their operational wallets.

According to security investigations, attackers gained access to systems capable of authorizing transactions.

The attackers also exploited Ethereum's EIP-7702 functionality in part of the operation.

EIP-7702 allows certain Ethereum accounts to authorize smart-contract functionality.

Investigators reported that attackers used compromised authorization mechanisms to enable malicious transfers.

This did not establish that Ethereum's underlying cryptography had been broken.

Instead, the attack involved systems and permissions used to operate wallets.

Why Wallet Balance Data Is Not Enough

Public blockchain records can show wallet balances and transfers.

However, they cannot necessarily reveal the internal approval procedures governing those transactions.

For example, an outside observer may see that a wallet holds $100 million.

That information does not reveal whether the exchange requires multiple independent approvals to move the funds.

It also does not establish whether automated withdrawal limits exist.

CertiK analyst Jonathan Riss previously explained that blockchain records provide only a partial picture of an exchange's internal security controls.

This reinforces the need for more meaningful security disclosures.

Coinbase Says Over 99% of Customer Assets Are Held Offline

Following the Binance incident, several exchanges publicly described their custody arrangements.

Coinbase reported that more than 99% of customer assets are held in cold storage.

The exchange also described additional protections involving distributed signing, withdrawal limits, anomaly detection, and emergency controls.

Bitnxt covered these disclosures in its report on Coinbase's cold-storage safeguards and wallet security measures.

Coinbase said its systems were not affected by the Binance incident.

However, the company's cold-storage percentage should be understood as one part of its security framework.

It does not independently establish the maximum amount of assets that could be lost through every possible attack.

Gate Reports 88.26% Cold Storage

Cryptocurrency exchange Gate reported holding 88.26% of its total assets in cold storage.

The figure is lower than Coinbase's reported percentage.

However, that difference alone does not establish which exchange has stronger overall security.

A meaningful comparison would also consider absolute hot-wallet balances, access controls, transaction limits, monitoring, and financial resources.

CertiK's recommendation challenges the assumption that a higher cold-storage percentage automatically means an exchange is safer.

How Crypto Cold-Storage Requirements Differ Across Countries

Several jurisdictions already require cryptocurrency service providers to keep minimum percentages of customer assets in cold storage.

These rules are intended to reduce online exposure.

However, regulatory frameworks differ.

These figures summarize the frameworks discussed in Cointelegraph's November 10 report; precise requirements depend on the jurisdiction and regulated activity.

CertiK does not argue that cold storage is unnecessary.

Instead, it suggests that minimum percentages should be complemented by financial exposure limits and operational safeguards.

This approach could provide a more complete assessment of exchange risk.

Binance Says It Has Replenished 98% of Affected Assets

Binance has continued providing updates about its recovery efforts.

The exchange said it had replenished approximately 98% of affected token balances using its own resources.

It also reported that certain less-liquid assets would take longer to replace.

However, replenishing customer balances is different from recovering stolen cryptocurrency.

An exchange can replace lost assets using corporate reserves or other resources even when the original stolen funds remain under attacker control.

Bitnxt previously explained this distinction in its Binance hack recovery and withdrawal update.

The recovery process also involves restoring affected services and reviewing security infrastructure.

Why Financial Recovery Is Only Part of the Solution

Replacing stolen funds can help protect customers from immediate financial losses.

However, it does not resolve the underlying security weaknesses that allowed the attack.

The longer-term questions concern how attackers gained access, which controls failed, and what safeguards have been introduced.

A successful recovery should include both financial remediation and technical improvements.

CertiK's recommendations focus primarily on the second objective.

Why Absolute Loss Limits Matter More as Exchanges Grow

The cryptocurrency industry has expanded considerably since its early years.

Major exchanges now manage large amounts of customer assets across multiple blockchains.

As custody balances grow, even a small percentage of online exposure can represent substantial financial risk.

This creates a problem for security models based only on ratios.

A fixed 1% hot-wallet allocation automatically increases in dollar value as total customer assets rise.

However, an exchange's ability to absorb losses may not increase at the same rate.

A hard dollar cap addresses this problem by establishing an upper limit on exposure.

Example of a Risk-Based Hot Wallet Policy

Consider a hypothetical exchange holding $50 billion in customer assets.

A 1% hot-wallet allocation would represent $500 million.

However, the exchange's risk management team might determine that a maximum loss of $100 million is the largest amount the business could absorb under its financial recovery plan.

Under a strict dollar-cap approach, the exchange would not automatically permit $500 million of online exposure simply because that amount represents only 1% of assets.

It would need to manage operational liquidity within the lower financial limit.

The example illustrates CertiK's principle rather than a specific recommended threshold.

CertiK has not established a universal dollar cap that every exchange should follow.

What Crypto Exchanges Can Learn From Traditional Banking Security

Traditional financial institutions use multiple layers of operational and financial risk management.

These can include transaction authorization limits, employee access controls, fraud monitoring, independent approvals, and incident response procedures.

Cryptocurrency exchanges can adapt similar principles to blockchain custody.

However, cryptocurrency transactions introduce distinct challenges.

Confirmed blockchain transfers generally cannot be reversed through the same mechanisms available for certain traditional financial payments.

Some stablecoin issuers may freeze specific tokens under applicable arrangements, but that capability does not exist for every cryptocurrency.

Bitcoin transfers, for example, cannot ordinarily be reversed by a central issuer.

This makes prevention particularly important.

Once attackers move funds to addresses they control, recovering those assets can become extremely difficult.

Blockchain Transparency Is Not the Same as Security

Public blockchains allow investigators to follow many cryptocurrency transfers.

This transparency can support tracing and forensic analysis.

However, observing stolen funds after they have moved does not necessarily allow investigators to recover them.

The Binance breach demonstrates the distinction.

Blockchain analytics firms have tracked stolen assets across multiple networks.

Nevertheless, significant recovery challenges remain.

Security systems must therefore aim to prevent unauthorized transactions rather than relying entirely on post-incident tracing.

Bitnxt Take: Exchanges Need to Measure the Maximum Damage, Not Just Storage Percentages

At Bitnxt, we believe CertiK's recommendation addresses a major weakness in how cryptocurrency exchanges communicate security to customers.

Cold-storage percentages are easy to understand.

An exchange claiming to keep 99% of assets offline appears safer than one reporting a lower percentage.

However, this comparison can be misleading.

The most important question is not simply how much cryptocurrency remains offline.

It is how much an attacker could realistically move if a critical system were compromised.

That amount depends on transaction permissions, signing infrastructure, withdrawal limits, and emergency controls.

The Binance breach demonstrated that sophisticated attackers may target the systems responsible for authorizing transactions rather than attempting to break blockchain cryptography.

This changes how security should be evaluated.

Our view at Bitnxt is that cryptocurrency exchanges should disclose more meaningful risk-management information, including how they limit transaction exposure, separate signing permissions, and respond to suspicious activity.

However, publishing exact security thresholds or sensitive operational details could also help attackers.

We therefore believe exchanges should provide independently verified evidence of effective controls without exposing information that would undermine those controls.

Security Should Be Measured Through Multiple Layers

We see four important areas for improvement.

The first is financial exposure management.

Exchanges should establish limits based on their ability to absorb potential losses.

The second is authorization security.

No single compromised system should automatically provide unrestricted access to large asset balances.

The third is real-time monitoring.

Unusual transactions should trigger rapid investigation and, where technically possible, automatic restrictions.

The fourth is independent verification.

Customers need reliable evidence that security procedures exist and operate as intended.

We also believe proof-of-reserves disclosures should be evaluated separately from operational security.

An exchange may demonstrate that it holds sufficient assets while still maintaining vulnerable transaction systems.

Solvency and cybersecurity are related but distinct responsibilities.

Could CertiK's Recommendations Influence Crypto Regulation?

The Binance incident has increased attention on cryptocurrency custody risk.

Regulators and financial institutions are evaluating how large digital asset platforms manage security.

Reuters reported that U.S. banking supervisors contacted financial institutions after the Binance breach to assess potential operational exposure.

The development illustrates how cryptocurrency cybersecurity incidents can raise concerns beyond the affected exchange.

As banks and cryptocurrency companies become more connected, weaknesses in digital asset infrastructure may create additional operational risks.

CertiK's recommendations could contribute to future discussions about custody standards.

However, there is no confirmed announcement that regulators have adopted CertiK's proposed dollar-cap framework as a universal requirement.

The recommendations remain cybersecurity guidance rather than a new global regulation.

What Should Crypto Investors Look for in an Exchange?

The latest security debate offers several practical lessons for cryptocurrency investors.

Cold-storage percentages can provide useful information, but they should not be the only factor considered.

Investors should also examine whether an exchange publishes security disclosures, uses strong account protections, maintains withdrawal controls, and provides transparent incident updates.

The financial condition of the exchange also matters.

A platform with strong security controls may still face risks if it lacks sufficient resources to respond to unexpected losses.

Customers should understand the difference between assets held through an exchange and assets held in self-custody.

Exchange custody transfers substantial operational responsibility to the service provider.

Self-custody gives users more direct control but also requires them to protect their own keys and recovery information.

Neither approach eliminates every risk.

The appropriate choice depends on individual requirements, technical capabilities, and risk tolerance.

What Happens Next for Crypto Exchange Security?

The next phase of the debate will likely focus on how exchanges demonstrate that their security controls are effective.

Several questions remain important.

Will major exchanges publish clearer information about their maximum operational wallet exposure?

Will independent auditors begin evaluating transaction authorization systems alongside asset reserves?

Can automated controls stop suspicious transfers before attackers move large amounts of cryptocurrency?

Will regulators introduce more detailed requirements for wallet access and operational loss limits?

And will exchanges establish stronger recovery arrangements for incidents involving multiple blockchains?

The answers could influence how institutional investors and retail customers evaluate cryptocurrency custody providers.

Final Thoughts

CertiK's call for strict hot-wallet dollar caps represents an important development in cryptocurrency security discussions.

The recommendation follows Binance's approximately $6.3 billion breach, which exposed weaknesses in wallet-signing infrastructure and operational controls.

Although cold storage remains an essential safeguard, CertiK argues that storage percentages alone cannot provide a complete measure of security.

Exchanges also need to consider absolute financial exposure, customer withdrawal requirements, transaction permissions, and emergency response systems.

The distinction becomes increasingly important as major cryptocurrency platforms manage larger asset balances.

Bitnxt believes the future of exchange security will depend on limiting the financial impact of successful attacks, not simply increasing the percentage of assets held offline.

Preventing every cyberattack may be unrealistic.

However, carefully designed transaction limits, independent approvals, and effective circuit breakers could help prevent a compromised system from turning into a multibillion-dollar financial disaster.