What happened
CertiK, the smart contract audit and security firm, called on centralized exchanges to adopt hard dollar caps on hot wallet balances, per a statement published by Cointelegraph on Tuesday. 'Cold storage is a useful measure of online exposure, but it is not a standalone security score,' the firm told the outlet. The argument is straightforward.
An exchange that holds 95% of assets in cold storage still exposes customers to catastrophic loss if the remaining 5% translates to $800 million sitting on a handful of hot signing keys. CertiK's position is that the ratio metric, which has become the default disclosure since the FTX collapse in 2022, obscures the absolute dollar figure that actually matters when a signer is phished or a bridge contract is drained.
The firm did not propose a specific cap level in the Cointelegraph piece, instead framing the recommendation as a governance principle exchanges and their auditors should codify.
Why it matters
The call arrives after a brutal eighteen months for hot wallet security. Bybit lost roughly $1. 5 billion in February 2025 to a Lazarus Group-attributed exploit of its Ethereum cold-to-hot transfer flow, the largest single theft in crypto history.
Smaller venues including Phemex, WazirX, and several Japan-licensed exchanges absorbed eight-figure drains across the same window. In every case the cold storage ratio looked healthy on the day of the hack. The absolute dollar amount sitting hot did not.
CertiK's framing shifts the conversation away from a percentage that scales with the exchange's book and toward a bounded liability number that an insurer, a regulator, or a customer can actually underwrite. It also lines up with the direction MiCA-authorised venues are being pushed by national competent authorities in Germany and France, where draft guidance in the second half of 2026 has floated explicit hot wallet exposure limits rather than ratios.