Cold Storage vs. Hot Wallets: How Exchanges Custody Your Crypto

Published August 1, 2026 · Updated August 1, 2026

AI-assisted content · Swoopr is responsible for the final published article.

Scope: The Exchange's Custody Decision, Not Yours

It's easy to confuse this topic with Swoopr's Hot Wallets vs. Cold Wallets guide, because both pages use the same two words. They cover two different decisions made by two different parties. That earlier guide is about you: if you hold crypto directly, in a wallet only you control, should you keep it in a hot wallet on your phone for convenience, or in a cold hardware wallet for security, and how do you weigh that trade-off for your own holdings? This page is about the exchange: when you deposit funds onto a centralized platform like an exchange or brokerage, you no longer hold that crypto directly, the exchange does, pooled together with every other user's deposits, and the exchange makes its own internal decision about how much of that pooled total sits in an internet-connected hot wallet versus offline cold storage.

The two decisions don't overlap, but they're both part of the same overall security picture. Funds you've moved to your own self-custodied wallet are governed entirely by the individual guide's trade-offs, your own hot-versus-cold choice, your own seed phrase practices, your own device security. Funds you leave on deposit at an exchange are governed entirely by that exchange's custody architecture, something you don't control and usually can't fully verify, but can and should evaluate before deciding how much to leave there. Read this page to understand and evaluate the second half of that picture; read the individual guide for the first half.

Key Takeaways

Direct answer: Exchanges keep a small, internet-connected hot wallet to process real-time user withdrawals quickly, and move the large majority of total user funds into offline, air-gapped cold storage that's dramatically harder for a remote attacker to reach. The security logic is simple: a smaller hot wallet caps the maximum plausible loss from a successful breach, since the bulk of funds simply aren't reachable through a hack of the exchange's online systems. Well-regarded exchanges commonly disclose keeping a high share, often cited around 90% or more, of user funds in cold storage, and that disclosure, backed ideally by proof of reserves, is a real due-diligence signal worth checking before you decide how much to deposit.

Hot wallets exist for withdrawal speed; cold storage exists for security. Exchanges need both, they just shouldn't be balanced anywhere near evenly.
A deliberately small hot-wallet balance limits an attacker's maximum possible theft even after a successful breach.
A commonly cited due-diligence benchmark is roughly 90% or more of total user funds held in cold storage, though this isn't a strict, universal, or independently enforced standard.
A disproportionate share of the largest historical exchange hacks involved unusually large hot-wallet balances relative to the exchange's total holdings.
An exchange's custody split is a factor in your own deposit decisions, not just an internal operational detail that's none of your business.
A stated cold-storage percentage is a claim until it's backed by some form of proof of reserves; treat unverified numbers with appropriate caution.

Why Exchanges Maintain Both Hot Wallets and Cold Storage

An exchange that processed every single withdrawal directly from offline cold storage would be extremely secure and completely unusable. Cold storage keys are, by design, kept on hardware that has never touched the internet, often split across multiple devices or locations under a multi-signature scheme that requires several authorized people to physically participate before funds can move. That's exactly what makes cold storage hard to steal from remotely, and exactly what makes it slow: a single cold-storage withdrawal can require coordinating multiple people, retrieving offline key material, constructing and signing a transaction in an air-gapped environment, and manually broadcasting it, a process that reasonably takes hours, sometimes closer to a full business day, and is deliberately not something one person can do alone at 2 a.m.

Users expect withdrawals in minutes, not the next business day. To meet that expectation, exchanges maintain a hot wallet, a wallet whose private keys are held on systems connected to the exchange's live infrastructure so that withdrawal requests can be signed and broadcast automatically and near-instantly. The hot wallet is sized to cover expected withdrawal volume over a given window, refilled periodically from cold storage through the same slower, more secure process described above, and drawn down as users withdraw. It's the exchange's operational reserve, the checking account sitting in front of the vault, sized for throughput rather than for holding the bulk of the balance sheet.

This split isn't unique to crypto exchanges. Traditional banks keep a small fraction of deposits as liquid cash on hand or in easily accessible reserves to cover day-to-day withdrawals and transfers, while the much larger remainder is invested, lent out, or held in less immediately liquid form. The crypto version of this logic is actually more conservative in spirit, since a well-run exchange's cold storage isn't invested or lent, it's simply held offline, inert, and inaccessible to anyone without physical access and multiple authorized signers. The goal isn't liquidity management in the banking sense, it's minimizing the attack surface an exchange exposes to the internet at any given moment, while still meeting the practical expectation that withdrawals happen quickly.

The Security Logic Behind the Split

The reasoning behind keeping hot-wallet balances deliberately small isn't just general caution, it's a specific, quantifiable containment strategy. Any system connected to the internet is, in principle, reachable by a sufficiently capable remote attacker: through a compromised employee credential, a vulnerability in exchange infrastructure, a supply-chain compromise of a signing tool, or a compromised key-management service. No exchange, no matter how well-resourced its security team, can reduce that probability to exactly zero. What a well-run exchange can control directly is how much is exposed if that low-probability event happens anyway.

That's the entire function of keeping the hot wallet small: it converts an unbounded worst case into a bounded one. If a hot wallet holds, say, two percent of an exchange's total user funds, then even a fully successful, worst-case compromise of that hot wallet caps the theft at roughly that two percent, not at the exchange's entire balance sheet. The other ninety-eight percent sitting in cold storage isn't protected by better passwords or a stronger firewall, it's protected by not being reachable through the internet-facing system that was actually compromised. This is a fundamentally different kind of security than most people are used to evaluating: it's not about preventing every possible intrusion, it's about architecting the system so that the worst plausible outcome of an intrusion is small relative to the whole.

This is also why the sizing of the hot wallet matters as much as its existence. A hot wallet sized generously "just in case" of unusually high withdrawal demand, rather than tightly to typical operational need, defeats the purpose of the split. The tighter an exchange keeps its hot-wallet balance to actual near-term withdrawal requirements, refilling frequently from cold storage rather than keeping a large standing buffer, the more the architecture actually delivers the containment it's designed for. An exchange that talks about maintaining cold storage but keeps a bloated hot wallet "for convenience" has the right idea and the wrong execution, and the practical security benefit of the split scales with how disciplined that sizing actually is.

What a Reasonable Cold-Storage Percentage Looks Like

There's no regulator-mandated, universally enforced minimum cold-storage percentage that every exchange must meet, which means the number you'll encounter is almost always a voluntary disclosure the exchange chooses to publish, rather than an audited requirement. Within that caveat, industry practice among well-regarded exchanges has settled around a rough, commonly cited benchmark: keeping somewhere around 90% or more of total user funds in cold storage, with the remaining single-digit-to-low-double-digit percentage held hot for operational liquidity. Some exchanges disclose figures higher than that; others are vaguer about the specific split or don't disclose one at all.

Treat that 90%-plus figure as a due-diligence question to ask, not as a pass/fail threshold you can apply mechanically. A few reasons that matters. First, the specific percentage varies by exchange, by asset, and over time, since withdrawal volume itself fluctuates and a responsible exchange adjusts its hot-wallet sizing accordingly rather than locking it to a fixed number. Second, a percentage alone doesn't tell you about the quality of the cold-storage implementation itself, whether it uses genuine air-gapped, multi-signature custody or something weaker dressed up in the same language. Third, and most importantly, a disclosed percentage is only as trustworthy as the verification behind it. An exchange stating "95% in cold storage" on a marketing page has told you what it wants you to believe, not necessarily what's independently confirmed to be true.

That last point is why cold-storage percentage and proof of reserves function as a pair rather than as separate topics. A percentage tells you what the exchange claims its custody split is; a proof-of-reserves process is the mechanism by which that claim, and the underlying total holdings behind it, can actually be checked against reality rather than taken on faith. Swoopr's Proof of Reserves Explained page covers how that verification works, what it does and doesn't prove, and how to read one. The short version here: ask for the percentage, but weight your confidence in that percentage by how well it's backed by independent verification, not by how confidently it's stated.

The Real-World Lesson From Major Exchange Hacks

This isn't a purely theoretical framework. Looking across the exchange hacks that have made headlines over the years, a consistent pattern shows up disproportionately often: exchanges that lost an unusually large share of their total holdings in a single breach tended to be ones that, for one operational reason or another, had an unusually large amount sitting in a hot wallet relative to their total balance sheet at the time of the attack. That's not true of every single incident, causes vary, and some breaches involved cold-storage failures, insider compromise, or flaws unrelated to hot-wallet sizing at all, but the broad pattern of oversized hot wallets showing up in a disproportionate share of the biggest losses is real and recurring enough to be a genuine lesson rather than a coincidence.

The underlying reason tracks directly with the security logic already covered above. When a hot wallet is sized tightly to near-term withdrawal needs, a breach of that wallet, however bad, is bounded by design. When a hot wallet balloons, whether through operational convenience, rapid unplanned growth in user deposits that outpaced updates to custody procedures, or simple negligence, the same category of breach stops being bounded and starts being catastrophic, because there's no longer a meaningful gap between "what the attacker can reach" and "what the exchange actually holds." History's clearest lesson isn't that hacks happen, they do, and no custody architecture eliminates that risk entirely, it's that the size of the loss tracks closely with how disciplined the hot-wallet sizing was going into the breach.

Swoopr's Exchange Hacks: History and Lessons page goes deeper into specific historical incidents and what each one changed about industry practice afterward. The relevant takeaway for this page is narrower and more actionable: an exchange's hot-wallet discipline isn't an abstract engineering detail, it's one of the more reliable predictors of how bad a breach could be if one happens, which makes it a legitimate factor in deciding how much of your own funds to expose to that risk.

Worked Example: Two Disclosed Custody Splits

Illustrative example — for education only.

To make the practical implication concrete, consider two hypothetical exchanges, each holding $500 million in total user funds, each with $10 million of your own crypto on deposit. Neither is a real exchange; the numbers are chosen to make the arithmetic easy to follow.

Exchange A publishes a custody disclosure stating it keeps 95% of total user funds in cold storage and 5% in a hot wallet, and backs that disclosure with a periodic proof-of-reserves attestation. At $500 million total, that means roughly $25 million sits in the hot wallet at any given time, spread across every user's proportional share of that pool, and $475 million sits offline. If Exchange A suffers a worst-case hot-wallet compromise, the maximum plausible loss across all users is bounded near that $25 million hot-wallet balance, meaning your proportional exposure, roughly 2% of the total pool, is a small fraction of your $10 million deposit, not the whole amount.

Exchange B doesn't publish a custody split at all, and in response to a support inquiry only says that funds are "kept secure using industry-standard practices." Absent any disclosed number, there's no way to know whether Exchange B's hot wallet holds 5% of total funds or 40% of total funds, both are consistent with "industry-standard practices" as a phrase, and history shows real exchanges have operated at both ends of that range. If Exchange B's actual hot-wallet balance turns out to be, hypothetically, $150 million of that same $500 million total, a worst-case breach exposes proportionally far more of every depositor's funds, including yours, than Exchange A's architecture would under the identical attack.

The two exchanges might have identical total holdings, identical marketing claims about "bank-grade security," and identical uptime records right up until the moment of a breach. What differs, and what a disclosed, verifiable cold-storage percentage actually tells you in advance, is the ceiling on how bad that moment can get. That's the whole point of asking the question before depositing, not after.

Due-Diligence Checklist

A short set of questions turns this from an abstract framework into something you can actually apply to a specific exchange before or while you hold funds there.

Does the exchange publish a specific cold-storage percentage, or only vague language like "the majority" or "industry-standard practices"?
Is that percentage backed by any form of proof of reserves, attestation, or independent audit, or is it stated without any supporting verification?
Does the exchange describe its cold-storage setup as genuinely offline and multi-signature, or does the description sound like it could be a warm wallet with a cold-sounding label?
Has the exchange's disclosed practices, or its total assets under custody, changed rapidly in a way that its stated hot-wallet sizing may not have kept pace with?
Does the exchange have a public history of past breaches, and if so, what did its custody split look like at the time, and what changed afterward?
How much of your own funds do you actually need sitting on the exchange for active trading, versus how much could reasonably move to self-custody or a separate arrangement?

Common mistake

The common mistake is treating an exchange's custody architecture as invisible background infrastructure, the kind of detail only relevant to the exchange's own engineers, rather than as a direct input into your own risk exposure. The custody split determines what happens to your specific deposited funds in the worst case, which makes it exactly as relevant to your decision-making as the exchange's fee schedule or supported assets, just less frequently advertised.

Misconceptions Versus Reality

Misconception	Reality
As a user, an exchange's custody split is entirely its own problem and doesn't affect my personal security decisions	An exchange's custody practices directly determine how much of your deposited funds are at elevated risk if that exchange is breached, which should inform how much you're comfortable depositing and leaving there
All exchanges handle hot-and-cold custody roughly the same way, so it isn't worth comparing between them	Disclosed cold-storage percentages, verification practices, and hot-wallet discipline vary substantially between exchanges, and that variance has repeatedly tracked with how large historical breach losses turned out to be
A stated cold-storage percentage is a proven, audited fact once an exchange publishes it	An unverified percentage is a claim; only a proof-of-reserves process or comparable independent verification turns that claim into something you can actually check against the exchange's real holdings
Keeping some funds in a hot wallet at all is itself a red flag or a sign of poor security	Every operational exchange needs some hot-wallet balance to process withdrawals in a reasonable time; the red flag is an oversized hot wallet relative to total holdings, not the existence of one
This topic is the same as choosing between a hot or cold wallet for crypto I hold myself	This page covers how an exchange custodies pooled user funds as an institutional decision; choosing a wallet for crypto you personally control is a separate topic covered in Swoopr's individual hot-vs-cold wallet guide

Common Mistakes That Increase This Risk

Never checking an exchange's custody-split practices at all before depositing. Most users research fees, supported coins, and trading interface before choosing an exchange, and never look at how it actually stores the funds they're about to hand over, even though that decision has a direct bearing on worst-case loss exposure.
Assuming every exchange handles custody the same way. Custody architecture, hot-wallet discipline, and verification practices vary meaningfully between platforms; treating "it's a big, well-known exchange" as a substitute for actually checking its disclosed practices skips the one factor that has repeatedly separated contained breaches from catastrophic ones.
Accepting a stated percentage without asking what backs it. A cold-storage figure with no attestation, audit, or proof-of-reserves process behind it is marketing copy until proven otherwise, and should be weighted accordingly rather than treated as settled fact.
Leaving far more on deposit than active trading actually requires. Even at a well-run exchange with a disciplined custody split, your proportional exposure scales with how much you leave there; funds not actively needed for trading are, by definition, funds exposed to exchange-level risk for no operational benefit.
Treating a large hot wallet as acceptable because the exchange is large and reputable. Size and reputation don't automatically translate into disciplined hot-wallet sizing; some of the largest historical losses occurred at platforms users considered established and trustworthy right up until the breach.

Risks, Limitations, and Exceptions

No custody architecture, however disciplined, reduces breach probability to zero; the hot-cold split bounds the potential size of a loss, it doesn't prevent every possible attack.
Cold storage itself can still be compromised through insider theft, a flawed multi-signature implementation, or mismanaged key backups, though these are structurally different and generally rarer failure modes than a hot-wallet breach.
An exchange can fail or lose user funds through fraud, mismanagement, or insolvency entirely unrelated to wallet architecture, which a cold-storage percentage says nothing about.
Disclosed cold-storage percentages are voluntary in most jurisdictions and aren't independently verifiable without a genuine proof-of-reserves process, so treat unverified figures as directional rather than certain.
An exchange's actual custody practices can change over time, sometimes without an updated public disclosure, particularly during periods of rapid growth in deposits.
Even a well-verified, well-disclosed custody split doesn't address other risks, such as withdrawal freezes, regulatory action, or platform insolvency, that are outside the scope of this page.

Tool Opportunity

A lightweight custody-disclosure tracker, letting a user look up or paste in an exchange's published cold-storage percentage and verification method, would make this due-diligence step something readers actually do rather than skip.

Recommended inputs: the exchange name, its disclosed cold-storage percentage if any, whether that figure is backed by a proof-of-reserves process or independent audit, and the approximate amount a user is considering depositing.

Expected outputs: a plain-language summary of the disclosed split, a flag for missing or unverified figures, and an estimate of proportional exposure in a hypothetical worst-case hot-wallet breach based on the user's own deposit amount.

Validation requirements: label every output as an estimate based on disclosed, potentially unverified figures rather than a guarantee, never present a percentage as audited fact without a cited verification source, and link out to the exchange's own disclosure or attestation page wherever one exists.

Sources

Chainalysis, reporting on cryptocurrency exchange hacks and the role of hot-wallet exposure in major historical breaches. See chainalysis.com.
Coinbase, public disclosure of its custody practices, including the use of geographically distributed, offline cold storage for the substantial majority of digital assets held on behalf of customers. See coinbase.com/custody.
U.S. Securities and Exchange Commission, Office of Investor Education and Advocacy, investor guidance on evaluating digital asset trading platforms and custody arrangements before depositing funds. See investor.gov.

Frequently Asked Questions

Is this the same topic as choosing a hot or cold wallet for my own crypto?

No. This page covers how an exchange custodies the pooled funds it holds on behalf of all its users, a business-level operational decision. Swoopr's Hot Wallets vs. Cold Wallets guide covers a completely different decision: how you personally choose to store crypto you control directly, in your own wallet, outside any exchange. The two decisions don't affect each other, but both matter to your overall security.

Why don't exchanges just keep all user funds in cold storage all the time?

Cold storage is offline and typically requires manual, multi-person procedures to move funds out, which is exactly what makes it secure but also makes it too slow for constant use. Exchanges need a smaller, internet-connected hot wallet to process routine withdrawals in minutes rather than hours, so the split exists to balance withdrawal speed against breach exposure rather than to maximize security alone.

What percentage of funds in cold storage should I look for at an exchange?

There's no universal legal minimum, but well-regarded exchanges commonly disclose keeping a high share of total user funds in cold storage, often cited around 90% or more in industry practice. Treat any specific number an exchange states as a due-diligence signal worth asking about rather than a guaranteed, audited fact, since the figure usually isn't independently verifiable without a proper proof-of-reserves process.

Does a small hot wallet mean an exchange can never be hacked?

No. A well-managed hot-to-cold split limits how much can be stolen in a single hot-wallet breach, but it doesn't prevent every kind of attack. Cold storage can still be compromised through insider theft, a flawed multi-signature setup, or a mismanaged private key backup, and an exchange can still fail through fraud or mismanagement that has nothing to do with wallet architecture at all.

Have exchange hacks actually been linked to large hot-wallet balances?

A disproportionate share of the largest publicly documented exchange breaches have involved hot wallets holding unusually large balances relative to the exchange's total holdings, rather than a proportionate operational reserve. That pattern is a recurring theme across major incidents, though the specific cause of each hack varies and isn't uniform across every case.

How can I actually verify an exchange's cold-storage claims instead of just trusting its marketing?

The strongest verification available today is a proof-of-reserves process, where an exchange cryptographically demonstrates it holds the assets it claims to hold, ideally paired with a comparable proof-of-liabilities showing what it owes users. A stated cold-storage percentage without any form of independent verification behind it is a claim, not a proven fact, and should be weighed accordingly.

Should an exchange's custody split change how much I deposit and leave there?

Yes. An exchange's custody practices directly determine how exposed your specific deposited funds are if that exchange gets breached, so they're relevant to your own risk decisions, not just the exchange's internal operations. Depositing only what you actively need for trading, and moving the rest to self-custody or a separate cold-storage arrangement, is the practical response to custody practices you can't fully verify.

Conclusion

An exchange's hot-and-cold custody split isn't back-office trivia, it's a direct, quantifiable statement about how much of your deposited funds are exposed if that exchange is ever breached. Hot wallets exist because withdrawals need to happen quickly; cold storage exists because the bulk of user funds shouldn't be reachable through the internet at all; the discipline with which an exchange sizes the former relative to the latter has tracked closely with how catastrophic real historical breaches turned out to be. Ask for a disclosed cold-storage percentage, weigh it against whatever verification actually backs it, and size how much you leave on any single platform accordingly. Pair this with Swoopr's Proof of Reserves Explained guide to understand how those disclosures can actually be checked, and the Exchange Hacks: History and Lessons page for the deeper historical record behind the pattern described here.