Major cryptocurrency exchanges moved to disclose cold storage asset ratios this week after a $6.36 billion hot wallet breach at Binance, with Coinbase and Upbit reporting over 99% of assets held offline while Gate revealed an 88.26% ratio under a new verification framework.
Key Takeaways
- Binance suffered a $6.36B hot wallet breach last week; the exchange has not disclosed a precise cold/hot storage split.
- Coinbase and Upbit report >99% cold storage; Gate discloses 88.26% via new PoSEC framework (unaudited); OKX states >95%.
- South Korea mandates an 80% minimum cold storage ratio; Upbit leads at 99.17%, while GOPAX sits near the floor at 80.54%.
- Reported ratios are not directly comparable due to differing methodologies and reporting periods.
- Fed and OCC are querying U.S. banks on exposure; Hong Kong SFC previously flagged cold wallet operational risks beyond storage ratios.
Executive Intelligence Brief
Exchange Disclosures and the Binance Catalyst
The disclosures follow an attack on Binance's hot-wallet infrastructure last week in which threat actors stole approximately $6.36 billion, most of it in about 20 minutes, according to blockchain intelligence firm TRM Labs. Binance CEO Richard Teng stated the 'vast majority' of user assets are held in cold wallets, but the company has not provided a precise split.
In response, Coinbase said in a blog post Wednesday that more than 99% of customer assets are held in offline cold storage and that it continuously rebalances excess assets to cold storage. 'Binance's reported hot wallet incident has understandably left customers asking how Coinbase protects customer assets from something similar happening here,' the company said.
Gate on Thursday launched a 'Proof of Security' (PoSEC) framework, reporting that 88.26% of its total assets were in cold storage and 11.74% in hot wallets. It claims its cold storage could cover 104.58% of customer assets even if its hot wallets were completely drained, though the data is still undergoing independent review by a third-party audit firm.
South Korea Sets Regulatory Benchmark
South Korea provides the clearest regulatory context. Upbit, the largest cryptocurrency exchange in the country, confirmed it holds 99.17% of its assets in cold wallets, with the remaining 0.83% in hot wallets as of September 2026. 'This represents the highest cold wallet storage ratio among South Korea's five major KRW-based cryptocurrency exchanges and is substantially above the regulatory minimum of 80%,' a spokesperson for Upbit parent company Dunamu told Cointelegraph. The exchange targets keeping hot wallet holdings below 1% of customer digital assets.
Financial Supervisory Service figures cited in earlier reporting put other major Korean exchanges at lower ratios: Bithumb at 94.76%, Coinone at 85%, Digital X (formerly Korbit) at 82.79%, and GOPAX at 80.54% at the end of September.
Comparability Limits and Structural Risks
OKX's existing security overview, last updated on Sept. 18, 2026, said it holds more than 95% of client crypto assets in cold wallets and less than 5% in hot wallets. However, the reported ratios are not necessarily directly comparable because exchanges use different reporting periods and may calculate cold-storage shares against different asset bases.
Cold storage ratios also offer only part of the picture of an exchange's security. Offline wallets can still be exposed through compromised signing systems, inadequate access controls, or employees approving fraudulent transactions. Hong Kong's Securities and Futures Commission warned in an August 2025 circular that such weaknesses could compromise both hot- and cold-wallet infrastructure.
Regulatory Ripple Effects
The breach has drawn attention from traditional financial regulators. The Federal Reserve and the Office of the Comptroller of the Currency are checking U.S. banks for exposure to the Binance hack, signaling heightened supervisory scrutiny of crypto-related counterparty risk in the banking sector.
