CertiK Urges Dollar Caps on Hot Wallets After $6.3B Binance Hack

Hard Dollar Ceilings Over Storage Ratios

Security firm CertiK has recommended that crypto exchanges place fixed dollar limits on the funds they hold in hot wallet accounts, arguing that cold-storage percentages alone give an incomplete picture of platform safety. The proposal arrives days after the record Binance breach, which targeted the exchange's online wallets and caused roughly $6.3 billion in losses, amid a wave of venues publishing cold-storage ratios to reassure customers that most funds sit out of reach of online attackers. Gate put 88.26% of its total assets in cold storage, while Coinbase reported over 99% of customer assets held offline, the custody model built around hardware wallet infrastructure. CertiK's research team said cold storage is a useful gauge of online exposure but cannot stand in for a full security score. CertiK's argument is that a high percentage can still sit alongside a large absolute sum online, and that sum is what an attacker can reach. In the firm's view, higher storage ratios generally cut online exposure, yet the benefit flattens at very high levels, and rigid quotas carry their own costs: they can slow withdrawals, force rushed transfers and stack risk inside key-management systems. Instead of ratio targets, CertiK wants each exchange to set a hot-wallet cap per asset and per blockchain at the strictest of three thresholds: a set share of customer liabilities, estimated withdrawal demand, and an absolute loss ceiling sized against the operator's finances and recovery capacity. Operating liquidity should stay flexible, the firm said, while hard dollar ceilings and circuit breakers bound the potential loss. National rules already diverge on the ratio question: South Korea requires at least 80% of customer assets by value in cold storage, Singapore's guidelines call for 90%, Japan's framework 95%, and Hong Kong's baseline for licensed trading platforms is 98%. CertiK framed the shift as moving the measurement question from where assets sit to how much a platform can lose in a single incident.

Binance Restocks 98% of Hacked Tokens

Binance says it has replenished approximately 98% of the tokens taken in last week's attack and will absorb the remaining loss on its own books. The replenishment update followed within days of the incident, with the exchange committing to cover the gap from its own resources. In a recovery update posted on Wednesday, the exchange noted that the tokens still outstanding trade with thinner liquidity and will take longer to source, leaving a small share of the shortfall unfilled for now. The update did not name the outstanding assets or give a completion date. The breach targeted Binance's online wallets, the same custody layer CertiK now wants capped, and the replenishment figure offers a first measure of how much of the loss the exchange could restore within roughly a week. Attention has meanwhile turned to where the stolen funds are going. Blockchain analytics firm Elliptic traced about $430,000 through six newly launched tokens on the NEAR network, which it attributes to North Korea-linked hackers using memecoin launches to build markets for the stolen assets. The tokens debuted with fresh liquidity pools that the actors then used to move value between addresses. Elliptic said the tracing covers what could be followed onchain so far and has not published an estimate of the total moved. Liquidity pools, the asset pools that let decentralized exchanges match trades without a direct buyer-seller pairing, made transfers between wallets harder to follow, though the transactions remain traceable onchain. The attack and the first replenishment statements both came last week, with the Wednesday update refining the picture for the final 2%. Binance has not said when the remaining tokens will be restored.

What the Cap Framework Changes

Read together, the two threads point the same way: public cold-storage ratios are becoming a reassurance metric rather than a risk measure. CertiK's recommendation, the load-bearing document in this debate, explicitly rejects a single-ratio scorecard and asks exchanges to quantify a maximum tolerable loss, a test that would bite hardest at venues now advertising the highest storage percentages. The $430,000 NEAR trail is small next to the $6.3 billion breach, but it shows proceeds moving through new token markets within days, so the absolute size of an online balance, not its percentage share, determines how much one incident can reach. Exchanges that disclose ratios without dollar caps leave that number unstated.