South Korea urges cold wallets after Binance hack

South Korea’s financial watchdog is urging domestic crypto exchanges to store more user assets in cold wallets, which are offline and immune to internet-based hacking. The request follows last week’s $6.3 billion theft from Binance, which solely affected its hot wallets connected to the internet.

• Playbook of the $6.3 billion Binance heist and a suspected $106 million theft

On 2 November, the Financial Services Commission held an emergency meeting with major exchanges. The session reviewed access controls and withdrawal approval mechanisms, and encouraged platforms to increase the proportion of assets kept offline. No new legal threshold was imposed.

The logic behind the recommendation is straightforward: hackers can only steal what is accessible online. Understanding the distinction between hot and cold wallets reveals why this is important and why it is not a full solution.

What hot and cold wallets are

A crypto wallet does not store coins like a physical wallet stores cash. Coins reside on the blockchain. What the wallet contains is the private key, a secret code for authorizing transactions. Whoever owns the key controls the coins.

The key difference between hot and cold is the location of this key.

• In a hot wallet, the key is on an internet-connected device or system, offering speed and convenience. This enables exchanges to process thousands of withdrawals daily and individuals to trade or pay quickly via a phone app.
• In a cold wallet, the key is stored offline on hardware, an air-gapped computer, or even paper. Transferring funds requires deliberate, often manual steps.

A useful parallel is a store’s cash register versus its bank vault. The register holds enough for daily operations, while the vault contains the bulk and requires time, personnel, and procedures to access.

Why cold storage offers more protection

Most major crypto thefts happen remotely. Attackers penetrate a network, often through a single compromised laptop or account, and work toward the systems that sign transactions. If the key or signing system is online, it is reachable. If offline, no network path exists, forcing attackers to gain physical access or deceive operators.

Cold storage also introduces delays, which function as a security feature. Moving funds out of cold storage generally involves multiple people, separate devices, and several approvals. This creates time for anomalies to be detected. A hot wallet, in contrast, moves funds instantly, and so does a thief who controls it.

The practical result is to limit damage. An exchange with 98% of user assets in cold storage has only about 2% online and at risk. A breach can still be significant but cannot drain the entire platform.

The drawbacks: cold storage is safer but not foolproof. Keys may be lost, damaged, or physically stolen, and employees may be tricked into approving a fraudulent transfer. Moreover, no exchange can operate entirely on cold storage, as hot wallets are needed for user withdrawals. Cold storage reduces risk but does not eliminate it.

How the Binance hack fits

Binance is a textbook example of both the strength and limitation of cold storage.

According to blockchain analytics firm TRM Labs, on 29 October an attacker transferred about $6.36 billion from Binance’s hot wallets across ten blockchains, most within 20 minutes. TRM believes the attacker seized control of the system used for signing hot wallet transactions rather than stealing the keys themselves. Binance’s initial investigation reportedly identified a compromised engineer’s laptop as the entry point.

Binance co-CEO Richard Teng has stated that the overwhelming majority of user assets are held in cold wallets and are only moved to hot wallets when customers withdraw. In essence, the vault remained secure while the till was cleared out.

The issue is scale. For an exchange of Binance’s size, even a small hot wallet portion can equate to billions. Binance claims no user funds were lost as it is absorbing the loss from company funds, but the incident shows that hot wallet security depends on the systems and people controlling it.

South Korea's rules and how its exchanges compare

South Korea is one of the few markets that quantifies cold storage requirements. Under its Virtual Asset User Protection Act, exchanges must keep at least 80% of customer crypto in cold wallets.

Most major domestic exchanges already surpass this requirement. Cold wallet ratios as of the end of September, based on Financial Supervisory Service data cited by local media:

• Upbit: 99.17%
• Bithumb: 94.76%
• Coinone: 85%
• Digital X (formerly Korbit): 82.79%
• GOPAX: 80.54%

The variation is significant. At 99%, roughly one coin in a hundred is online and exposed. At 80%, it is one in five. This is why the FSC asked exchanges to increase their ratios beyond the minimum.

The regulator also called for stricter controls on withdrawal approvals and admin access, continuous monitoring of deposits and withdrawals, more incident response staff, quicker sharing of suspicious access attempts, and larger reserves. This list is informative. It focuses on the approval and signing systems that TRM identified as Binance’s weak point. South Korea has its own experience: Upbit lost about $30 million in a hot wallet hack in November 2025 and later moved 99% of assets offline.

What it means for traders and investors

If you hold crypto on an exchange, you rely on its balance between hot and cold storage and its ability to cover losses if problems occur. Two questions to consider: what percentage of user assets is stored offline, and what reserves, insurance, or corporate funds back them? Some exchanges disclose proof of reserves or cold storage figures, but many do not.

The same trade-off applies to individuals. Storing crypto on an exchange or in a phone app is the hot option, convenient for trading but dependent on the platform’s security and your device. A hardware wallet is the cold option, harder for remote attackers to access but placing responsibility for the key on you, and loss could mean permanent loss of the coins.

There is no one-size-fits-all answer. Many users split their funds, keeping trading amounts on an exchange and long-term holdings offline. The goal is to make this choice consciously rather than by default.

What to watch next

• Whether South Korea converts the recommendation into a rule. A higher minimum than 80%, or new requirements for signing systems and reserves, would signify a major policy change. Currently, it remains guidance.
• Binance’s root cause report. The exchange has not yet released a detailed account of how its signing systems were compromised. This will determine whether the lesson concerns cold storage ratios or hot wallet controls.
• Other regulators. If authorities in other regions follow suit with cold storage or disclosure requirements, exchanges may need to publish their ratios, providing users with a clearer basis for comparison.
• Customer behavior. Binance experienced billions in net outflows when withdrawals reopened. A sustained move of coins from exchanges to self-custody would indicate users are responding to the risk.

What could change the picture: if the Binance investigation reveals that the breach could have reached cold systems, the discussion would shift from offline storage ratios to how approvals are protected. Regardless, the relevant question for readers remains: what amount of my crypto is online and accessible, and what stands behind it if lost?