While a tougher cold storage rule could protect customer assets from hackers, smaller exchanges may struggle to process withdrawals quickly.
Last week’s Binance security breach was the most devastating attack in crypto history. It exposed the risks facing exchanges and the customers who trust them with their assets.
The incident has now prompted South Korean regulators to reconsider how much customer money exchanges should keep in offline storage. The latest reports suggest that discussions are underway to raise the existing requirement significantly.
Cold Storage Rule
According to News1, the Financial Services Commission held an emergency security meeting with major virtual asset exchanges and custody firms to examine ways to strengthen asset protection. Under the existing Virtual Asset User Protection Act, exchanges are required to keep at least 80% of customer assets in cold wallets, which remain disconnected from the internet, while the rest can be held in hot wallets to facilitate withdrawals and other transactions.
However, regulators are now discussing whether the minimum should be brought closer to 99%, a level already maintained by some major platforms.
The proposed change could create major challenges, particularly for smaller exchanges that may not have the same operational capacity as larger competitors. Although cold wallets offer stronger protection against online attacks, accessing funds stored in them involves additional approval and signing procedures. This means exchanges could have less money readily available to process customer withdrawals.
The concern is not limited to inconvenience.
In a market where crypto prices are highly volatile, delayed withdrawals could prevent investors from moving their holdings when they need to sell or transfer them. If an asset is rapidly losing value, waiting for funds to be released from offline storage could leave investors exposed to further losses.
You may also like:
There is already an example of how this can happen. Bithumb experienced withdrawal delays of approximately 13 hours for certain altcoins in August after insufficient hot wallet balances forced the exchange to move additional assets from cold storage.
Weak Links Behind the Heist
More than $6.3 billion in cryptocurrency was stolen in the Binance breach, which the FBI has attributed to the North Korea-linked hacking group TraderTraitor. Pyongyang has denied responsibility. Kim Yo Jong, department director of the Central Committee of North Korea’s Workers’ Party, dismissed Washington’s allegations as politically motivated.
The incident has also prompted scrutiny of how exchanges secure their internal systems. CoinEx founder Haipo Yang, for one, identified three security weaknesses at Binance that he believes could have been avoided. First, he said the exchange had not properly “isolated” its development and operations environments. Employees with access to production systems should use dedicated machines, with coding, messaging, and web browsing kept on separate devices.
His second concern was the lack of meaningful two-factor authentication for production access. The exec said a single compromised key was enough to give an attacker access to live systems. Yang suggested using AWS Session Manager with hardware security keys to ensure that one stolen credential would not be sufficient.
Questions were also raised about Binance’s multisignature security setup. Yang pointed out that the different parties involved in approving transactions were not independently verifying them. He said this defeated the purpose of having multiple signers, as compromising one node could put the entire system at risk.
No Comment! Be the first one.