Cold Storage vs Hot Wallets: Behind the 95% Claim

Two wallets, two threat models

A hot wallet holds its private keys on systems connected to the internet so withdrawals can be signed automatically, around the clock. A cold wallet keeps keys on hardware that never touches the network, with transactions signed offline and often requiring several people in a physical ceremony. The difference is not temperature, it is attack surface.

Almost every large exchange theft in history has come through hot wallets or the systems that feed them. Coincheck lost $530 million in NEM in 2018 specifically because it kept that entire balance in a hot wallet without basic controls. Cold storage failures are rare enough to be newsworthy on their own.

What the 95% claim actually means

When an exchange says 95% of funds are in cold storage, it is describing a policy target, not a verified fact. No outside party audits the split in real time, and the number can move with withdrawal demand. During a panic, exchanges shift coins from cold to hot to keep withdrawals flowing, which is precisely when the hot side is fattest and most attractive.

The claim still carries information. A venue that caps its hot float at 2 to 5% caps the blast radius of a hot wallet breach at the same level. KuCoin's 2020 hack drained around $280 million, but the firm survived partly because the loss was a float, not the treasury.

Multisig: the older standard

Traditional cold storage uses multisignature wallets. A transaction might require 3 of 5 keys, held by different officers in different locations. A thief or a rogue insider needs to compromise multiple people and places at once, which is what makes cold multisig storage so resistant to remote attack.

The cost is speed. Gathering signers for an on-chain multisig ceremony takes hours or days, which is why exchanges keep a hot float at all. Multisig also leaves a visible on-chain footprint and is implemented differently on every blockchain, an operational headache for venues listing hundreds of assets.

MPC: the newer approach

Multi-party computation splits a single private key into shares held on separate machines. The shares jointly compute a signature without the full key ever existing in one place, on any device, at any moment. Compromising one server yields nothing usable.

MPC blurs the old hot-cold line. An MPC wallet can sign quickly enough for withdrawals while offering security closer to cold storage, and it works identically across chains. Most large venues, including Binance, OKX and Bybit, now run MPC infrastructure somewhere in their stack. The trade-off is that MPC security depends on the vendor's implementation, which nobody outside can inspect.

How we read storage claims

We score from public evidence: published storage policy, proof-of-reserves cadence, and above all the incident record. A venue that has run for a decade without losing customer funds has demonstrated its storage discipline in the only test that counts. Kraken, operating clean since 2011, is our reference case.

We are upfront that we cannot see inside anyone's key management. Security weighs 20% in our base model and about 30% on the safest-exchanges page, and the never-hacked bonus exists exactly because outcomes are verifiable while architecture claims are not.

FAQ