Hot / Cold Wallet Ratio: How Exchanges Actually Decide What to Keep Online

You run a crypto exchange, and every morning the same question sits in front of your treasury team: how much do you leave in the hot wallet to clear withdrawals fast, and how much do you push to cold storage so a single breach can't drain the float?

Set the hot balance too high and you carry exposure you don't need; set it too low and withdrawals stall the moment volume spikes.

There is a number that gets this wrong all the time, and it has a price. In 2018, the Japanese exchange Coincheck lost about $530 million in NEM that it had kept in an internet-connected hot wallet without adequate multi-signature protection.

Cold storage was never the weak point. The hot wallet simply held far more than it ever needed to.

What hot cold wallet ratio should an exchange use?

There is no single correct percentage, and any vendor quoting you one is guessing. The hot cold wallet ratio is set by withdrawal coverage: size the hot float to the number of days of expected withdrawals you must fund without a cold-to-hot transfer, push the rest to cold, then enforce that ceiling automatically. Most exchanges land in the low single digits of total assets in hot wallets, but the percentage is an output, not the input.

The input is operational continuity. The hot float is a working balance, the amount you need on hand to clear withdrawals at your real volume between cold replenishments. Cold storage holds everything that balance doesn't require today.

Once you frame it that way, the threshold question stops being "what percentage feels safe" and becomes "how many days of withdrawals can we fund before we need to touch cold storage."

How do you size the hot wallet float?

Start with your own withdrawal data, not a benchmark. The hot wallet float should cover expected outflows across a defined replenishment window plus a buffer for volume spikes. The exchange that sizes its float to actual demand carries less idle exposure than one that picks a round percentage and hopes.

A working method has four steps.

First, measure your average daily withdrawal volume per asset over a representative period, then take a high-percentile day rather than the mean so a busy day doesn't drain you.

Second, decide your replenishment window: how often your operations team is willing and able to run an approved cold-to-hot transfer. A float covering two days of withdrawals means cold replenishment happens at least every two days.

Third, add a buffer for spikes, often expressed as a multiplier on the high-percentile day.

Fourth, set the refill threshold: the hot balance level that triggers a top-up before the float runs dry.

The hot cold wallet ratio falls out of that calculation. If your high-percentile daily withdrawal across all assets is a known figure and you hold two days plus a buffer, that hot balance over total assets under custody is your ratio. It will drift as volume grows, which is why the threshold matters more than the snapshot percentage.

For the broader hot versus cold tradeoff and where each tier fits, see this piece

Why does cold storage allocation fail even when the ratio is right?

A correct ratio doesn't protect you if the transfer process between tiers is weak. The Coincheck loss was overexposure. The other failure mode is the moment funds move between cold and hot, and that moment has produced the largest theft on record.

On February 21, 2025, Bybit lost about $1.5 billion of ether during a routine cold-to-warm transfer, when attackers manipulated the multisig signing interface so signers approved a transaction that did not match what they believed they were authorizing. The cold storage held.

The governance around its transfer did not. Cold storage is only as safe as the approval process that moves funds out of it.

The pattern holds across the wider data. In 2024, about $2.2 billion in crypto was stolen, and private key compromises were the single largest category at 43.8% of stolen value. The ratio question and the governance question are one decision: where the line sits, and who is allowed to move funds across it.

The custody tier model: hot, warm, cold

Most exchange treasury teams already think in tiers, and the hot cold wallet ratio lives inside that model. The hot tier holds the working float for automated withdrawals. The warm tier, where used, holds a staging balance with tighter access than hot but faster than cold. The cold tier holds the reserve offline, moved only through deliberate, approved transfers.

Each tier gets the same three controls applied at different strictness. The first control is the balance ceiling: the maximum that tier is allowed to hold before funds sweep down to a colder tier. The second is the refill trigger: the balance floor that initiates a top-up from a colder tier. The third is the approval requirement: how many reviewers, at what thresholds, must sign before funds move up toward hot. Hot sweeps to cold automatically and frequently. Cold-to-hot moves slowly and under human approval.

How do you enforce the hot cold wallet ratio automatically?

A policy that depends on someone remembering to move funds is not a policy. The hot cold wallet ratio holds only when the ceiling and the approval gate are enforced by the system, not by discipline. This is the part CoinsDo handles: you set the policy, the platform enforces it.

CoinsDo runs on self-custody, so you control your keys and CoinsDo never holds them. On the sweep side, CoinGet's Auto-Collection consolidates assets from multiple deposit addresses into your main wallets based on time, balance, or custom rules, and it can also route collected funds to cold storage automatically. That keeps the hot tier from accumulating past its ceiling without anyone watching it.

[[screenshot: coinsdo-coinget-configure-collection-address: sweep and collection address configuration showing rotation and limitation modes]]

sweep and collection address configuration showing rotation and limitation modes

On the cold-to-hot side, the direction that needs control, CoinSend governs the transfer. Its Custom Approval Flows let you define reviewer tiers, thresholds, and escalation logic, so a top-up above a set value requires more signers or a higher tier of approver. Approval Expiry Controls put a configurable time limit on each approval, so a stale authorization can't be replayed later. Inside CoinSend, CoinSign is the approval layer: it uses Bank-Grade Digital Signatures (RSA, HMAC-SHA256) to produce an unforgeable authorization trail of who approved what.

That trail is what the Bybit signers lacked: a verifiable record that the transaction signed matched the transaction intended. CoinSend also runs automated 24/7 withdrawals, which is what lets a lean hot float work. A smaller hot balance only clears withdrawals reliably if top-ups are automated and approval-gated rather than waiting on a manual batch. The platform is API-first with no node infrastructure to maintain, so the enforcement runs against your own systems.

approval signing for a cold-to-hot transfer

See how CoinGet and CoinSend automate hot/cold allocation and approval governance here.

Without and with enforced governance

Picture an exchange treasury team running the ratio by hand. The hot wallet drifts above its ceiling because the daily sweep is a manual job someone skipped during a busy week. A cold-to-hot top-up gets approved over chat, with no expiry and no signed trail. When volume spikes, an operator raises the hot balance "just for today" and forgets to bring it back down.

Every one of those gaps is a place where the real ratio diverges from the policy on paper.

Now picture the same team with the controls enforced. Sweeps to cold run on a schedule with no human in the loop, so the hot tier can't drift past its ceiling.

Cold-to-hot top-ups route through tiered approvals sized to the transfer value, each approval expires if not run, and every authorization leaves a signed record.

The temporary "just for today" increase still requires the same approval as any other top-up. The policy and the live state stay in sync because the system, not memory, holds the line.

For how this compares to handing custody to a third party, see here

For the underlying model, see here.

How to compute and enforce your hot float: A checklist

Use this as the decision aid your treasury and security teams work through together.

1. Pull average and high-percentile daily withdrawal volume per asset over a representative period.
2. Set your replenishment window: how often you will run an approved cold-to-hot transfer.
3. Size the hot float to that window's withdrawals plus a spike buffer.
4. Set the refill threshold that triggers a top-up before the float runs dry.
5. Set the hot-tier balance ceiling that triggers an automatic sweep to cold.
6. Define approval tiers and thresholds for cold-to-hot transfers by value.
7. Put an expiry on every approval so stale authorizations can't be replayed.
8. Confirm every cross-tier movement leaves a signed, auditable trail.
9. Review the resulting hot cold wallet ratio monthly against current volume and adjust the float, not the percentage target.

The hot cold wallet ratio is the output of steps one through four. Steps five through nine are what keep the output from drifting once it's set.

FAQ

What is the hot cold wallet ratio for an exchange?

The hot cold wallet ratio is the share of total custodied assets an exchange keeps in internet-connected hot wallets versus offline cold storage. It is set by withdrawal coverage needs, not a fixed percentage, so the hot balance covers expected outflows between replenishments.

How much crypto should an exchange keep in a hot wallet?

An exchange should keep only enough in its hot wallet to clear expected withdrawals across its chosen replenishment window plus a buffer for volume spikes. Most exchanges hold low single-digit percentages of total assets, but the figure depends on real withdrawal volume.

How do you set hot wallet security limits at an exchange?

Set a hot-tier balance ceiling that triggers an automatic sweep to cold storage, and a refill threshold that triggers an approved top-up. Enforce both through the platform rather than manual process, so the live balance cannot drift past the policy limit.

What crypto cold storage percentage should an exchange hold?

The cold storage percentage is whatever total assets remain after sizing the hot float to withdrawal coverage. For most exchanges that places the large majority of assets in cold storage, with the exact figure moving as withdrawal volume and the replenishment window change.

Who should approve cold-to-hot transfers at a crypto exchange?

Cold-to-hot transfers should require tiered approval scaled to transfer value, with higher-value top-ups demanding more reviewers or senior approvers. Each approval should carry an expiry and produce a signed, auditable record so the signed transaction provably matches what was authorized.

Does CoinsDo decide the hot cold wallet ratio for you?

No. CoinsDo does not set the ratio; you define the policy. The platform enforces it by sweeping the hot tier to cold automatically and gating cold-to-hot transfers behind custom approval flows, expiry controls, and a signed authorization trail.