Cold storage and hot wallets: where an exchange keeps your coins

A hot wallet is a private key held on a machine that is connected to the internet, so it can sign a transaction the instant one is required. Cold storage is a key held on hardware with no network path to it, so getting funds out takes a person, a procedure, and usually more than one signature.

Everything else about the subject follows from one fact: a venue is not holding your coins. It is holding keys.

What a venue actually custodies is a key, not a coin

Coins are not objects that can be put in a vault. A chain is a ledger, and a balance on that ledger moves only when a transaction is signed by the private key that controls the address holding it. So when a venue says it holds your coins, what it physically possesses is a secret number. Custody is key management, and nothing more.

That reframes the whole question. The risk is not that someone walks off with your coins. The risk is that someone else obtains the key, or that the key stops existing, or that the keys the venue holds in total do not add up to what it owes its customers in total.

It also explains why your balance on the venue is not a chain entry at all. Customer funds are normally pooled into a small number of addresses, and your individual holding is a row in the venue’s own database. The chain sees the pool. Only the venue sees you. That is the same structure as a pooled client money account at a broker, and the implications are similar: see what segregated client money means.

Why no venue can keep everything offline

A withdrawal request arrives when a customer decides to make one, which is to say at an unpredictable moment, often at the worst possible moment for everybody at once. A key sitting offline cannot answer that. Someone has to be present, the hardware has to be brought into use, and the approvals have to be collected. That procedure exists precisely because it is slow and awkward, since slow and awkward is what stops a single compromised laptop from draining everything.

So the venue keeps a float online. The float pays ordinary withdrawals automatically, and gets refilled from the offline reserve periodically. Take a three tier split as an illustration. The tiers below are a model this article is setting out to show how the trade works, not a description of how any venue is arranged:

The split is a straight trade. More online means faster service and more that can be stolen in a single incident. More offline means less can be stolen and more withdrawals have to wait for a human.

What the split does to your withdrawal

Suppose a venue keeps 2% of one coin’s customer balances hot and 98% cold. That 2% is a figure this article invented to make the arithmetic visible, not something any venue is being said to use. Say the pooled customer balance of that coin is 10,000 units, also invented. The hot float is then 200 units.

If net outflow runs at, say, 60 units a day, the float covers a little over three days before a refill is needed, and nobody notices anything. Now imagine a day where withdrawal requests total 500 units. The first 200 units clear automatically. The remaining 300 cannot be signed, because there is no online key with anything left behind it. Those requests sit in a queue until someone executes a cold storage refill.

Nothing went wrong in that example. No fraud, no insolvency, no frozen account. The customer at position 201 in the queue simply hit a mechanical limit, and the fix is a staffed procedure that runs on business hours rather than on demand. This is why withdrawal speed varies by day with no change to your account, and why venues batch withdrawals into periodic sweeps: a batch of many payouts in one chain transaction costs far less in network fees than signing each one separately.

It also gives you a precise diagnostic. If you have a transaction hash, the venue has signed and broadcast, and the remaining wait belongs to the chain. If you have no hash, the transaction has not been created, and the delay is inside the venue. Those are different problems with different time horizons, and the hash tells you which one you have.

The mistake: reading a cold storage percentage as proof your coins exist

The common error is treating a high cold storage figure as an answer to the solvency question. It is not. It is an answer to the theft question.

The two are separate. Cold storage tells you how hard it is for an outsider to move the keys the venue holds. It says nothing about whether the total of those keys matches the total of what customers are owed. A venue could hold the great majority of its keys offline and still be short, if it lent out, lost or never had the balance it records against customer accounts. A percentage describes the composition of holdings. Solvency is a comparison between holdings and liabilities, which is a different sum entirely, and the one that reserve attestations attempt to address.

The mirror of this mistake is just as common: reading a fast withdrawal as proof of solvency. A hot float sized for ordinary traffic will service ordinary traffic perfectly well right up until the day it cannot, so an instant payout confirms only that the float was adequate at that moment.

The useful habit is to ask what any given claim is attached to. A statement about where keys sit is a statement about theft resistance. A statement about totals is a statement about solvency. A delay in your own withdrawal is usually a statement about the float and the refill schedule, which is the most boring explanation and also the most frequent one. For the broader question of what oversight of a venue does and does not guarantee, start with what a regulated broker actually means, and keep the custody question on your list before you fund anything: the pre-trade checklist.

Education only, not financial advice, and trading carries a risk of loss.