Crypto exchanges should put hard dollar ceilings on what they keep in hot wallets, security firm CertiK said, arguing that the cold-storage ratios venues rushed to publish after the record $6.3 billion Binance hack do not measure real exposure.
MoneyTurkey Crypto Desk | 10 November 2026
Key points
- CertiK wants per-asset, per-chain hot-wallet caps set at the strictest of three limits: a share of customer liabilities, expected withdrawals, and an absolute loss ceiling.
- Gate says 88.26% of its total assets sit in cold storage; Coinbase says more than 99% of customer assets are offline.
- Elliptic traced about $430,000 of the Binance haul through six NEAR memecoins created between Nov. 5 and 7.
What CertiK proposed
“Cold storage is a useful measure of online exposure, but it is not a standalone security score,” CertiK’s research team told Cointelegraph. The firm said each venue should cap hot-wallet balances for every asset and blockchain at the lowest of three numbers: a percentage of customer liabilities, estimated withdrawal needs, and an absolute loss ceiling based on the exchange’s own financial resources and ability to recover from a breach.
“Flexibility should support operating liquidity, while hard dollar ceilings and circuit breakers limit potential loss,” the team said.
Why the ratio race misses the point
Since the Binance breach, which targeted hot wallets, exchanges have competed on cold-storage percentages. Gate reported 88.26% of total assets in cold storage and Coinbase said it keeps more than 99% of customer assets offline. A high ratio still leaves a large dollar sum online at a big venue, which is the gap a hard cap is meant to close.
Where the stolen funds are going
Blockchain analytics firm Elliptic said North Korean hackers created at least six memecoins on the NEAR blockchain and used decentralized-exchange liquidity pools to move roughly $430,000 of the stolen funds without direct wallet-to-wallet transfers. The tokens drew almost no outside trading and were abandoned soon after launch. Elliptic said the same method moved at least $24 million through a new TRON token after the $1.5 billion Bybit hack in 2025.
Also today
The European Central Bank, European Commission and European Securities and Markets Authority are seeking nominations for an industry-led European Tokenisation Standards Group to draft common standards for holding and settling tokenized securities. Applications close Nov. 27 and work starts in January 2027.
What to watch
- Whether large exchanges publish hot-wallet dollar limits, not just cold-storage ratios
- Further Elliptic tracing of Binance-hack proceeds
Related on MoneyTurkey
For information only. Not investment advice.
Sources
- Cointelegraph, “Here’s what happened in crypto today” (10 Nov 2026): cointelegraph.com
