“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” the cybersecurity firm told Cointelegraph.
Crypto exchanges should impose hard dollar limits on their hot-wallet holdings rather than relying solely on cold-storage ratios to measure security, according to cybersecurity firm CertiK.
The recommendation came as several crypto exchanges recently disclosed how much they held in cold wallets, seeking to reassure customers after the record Binance hack that targeted its hot wallets. Crypto exchange Gate reported that 88.26% of its total assets were in cold storage, while Coinbase said it keeps more than 99% of customer assets offline.
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph.
South Korea requires crypto service providers to keep at least 80% of customers’ crypto assets by value in cold storage. Singapore’s guidelines call for at least 90%, while Japan’s framework requires at least 95% and Hong Kong’s baseline for licensed crypto trading platforms is 98%.
CertiK said that while higher cold-storage levels generally reduce online exposure, the benefit becomes less significant at very high levels.
Related: Analysts see no broader ‘contagion’ from $6.3B Binance hack
Rigid storage ratios could also slow withdrawals, force rushed transfers and concentrate risk in key-management systems.
CertiK said crypto exchanges should consider setting hot-wallet caps for each asset and blockchain according to the strictest of three limits: a percentage of customer liabilities, estimated withdrawal needs and an absolute loss ceiling based on the exchange’s financial resources and recovery capabilities.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” they said.
Binance says it has replaced 98% of affected assets
Binance last week said it had replenished approximately 98% of affected tokens following the hack and would absorb the losses. In a recovery update on Wednesday, the exchange said the remaining tokens were less liquid and would take longer to acquire.
Meanwhile, North Korea-linked hackers have created memecoins to launder funds from the theft, according to Elliptic. The firm traced roughly $430,000 through six newly launched tokens on NEAR, where liquidity pools helped obscure transfers between wallets, though the transactions remained traceable onchain.
Magazine: Vitalik ‘pivots’ ETH to store of value, crypto suffers after US midterms: Hodler’s Digest