How Crypto Exchanges Protect Your Funds: Cold Storage, Proof of Reserves and Proof of Security Explained

When around $6.36 billion was drained from Binance's hot wallets on October 29, 2026, every crypto trader asked the same question: how safe is my money on an exchange? The answer depends on something most users never check — how the exchange stores its coins. This guide explains the three layers that separate a well-run exchange from a risky one: cold storage, proof of reserves, and the new proof-of-security standard.

Hot wallets vs cold storage: the first line of defence

An exchange keeps two kinds of wallets. A hot wallet is connected to the internet, so it can process deposits and withdrawals instantly. That convenience is also its weakness: anything online can be attacked, and the Binance theft hit hot-wallet infrastructure.

A cold wallet is kept offline — on hardware devices or with an independent custodian, disconnected from the internet. Moving coins out of cold storage needs several people to approve the transfer, which makes a fast theft far harder. The industry rule of thumb is simple: the bigger the share of assets in cold storage, the smaller the amount an attacker can reach in one strike.

That is why exchanges started publishing their split this week. Gate, a major exchange, launched a "Proof of Security" (PoSEC) framework on November 5, 2026, reporting that 88.26% of its total assets sit in cold storage and only 11.74% in hot wallets. Its cold storage alone could cover 104.58% of customer assets — meaning users would stay whole even if every hot-wallet coin were lost. The figures come from a snapshot taken at 00:00 UTC on November 4, 2026, and are still being checked by an independent audit firm.

Proof of reserves: do they actually hold what they claim?

Cold storage tells you where the coins are. Proof of reserves tells you whether the exchange holds enough of them. Under a 100% reserve policy, an exchange holds at least one dollar of assets for every dollar customers deposited — so a rush of withdrawals cannot leave it short.

Exchanges prove this with cryptography, not promises. They publish a Merkle tree — a tamper-proof list that lets any user check their own balance is included in the total — combined with zk-SNARKs, which verify the numbers without exposing anyone's private data. Gate reported total reserves of about $8.688 billion as of October 18, 2026, a reserve ratio of 118.49% of user assets.

Proof of reserves has a limit, though: it shows the coins exist, not how safely they are stored. That gap is exactly what proof of security is meant to close.

Proof of security: the new standard

Proof of Security (PoSEC) answers one question: if all hot-wallet assets were lost, could cold storage cover every customer? The metric is the cold-storage coverage ratio — cold storage divided by user assets. A ratio of 100% or more means yes.

• Above 100%: cold storage alone covers all user assets. Gate's 104.58% is the first published example of this standard.
• Below 100%: the exchange depends on its hot wallets to stay whole — a bigger risk if those wallets are hit.
• Unaudited: the numbers are self-reported until an independent auditor signs off. Gate's data is still under third-party review, and traders should watch for the published audit report.

Even Gate's own chief executive has said the standard cannot verify internal passwords, private-key handling or access controls — the human weaknesses hackers often target. Storage is one layer, not the whole building.

What to check before you trust an exchange

• Cold-storage share: look for a published hot/cold split. The higher the cold share, the better.
• Reserve ratio: it should be at least 100%, ideally verified by an auditor, not just claimed.
• Coverage ratio: if the exchange publishes proof of security, check that cold storage covers 100% or more of user assets.
• Audit status: self-reported numbers are a start; a completed third-party audit is the real test.
• Withdrawal history: an exchange that froze withdrawals for days after an incident is telling you something about its liquidity.

The Binance hack, which the FBI has attributed to North Korean hackers and which our report on the Binance incident covers in detail, changed the conversation overnight. Exchanges can no longer ask for trust — they have to show their storage, their reserves and their audits. For everyday traders, the habit to build is simple: before leaving coins on any exchange, check its cold-storage share and its reserve ratio the same way you would check a bank's balance sheet. You can learn how to read an exchange order book in our guide, and the latest exchange developments are covered daily on the Zimbuck News page. Discuss this in the Zimbuck Market News group.

FAQ

Why is cold storage in crypto? Coins held completely offline — on hardware devices or with an independent custodian — so they cannot be reached over the internet. Moving them requires multi-party approval.

What is proof of reserves? A cryptographic check (usually a Merkle tree plus zk-SNARKs) proving an exchange holds at least as many assets as its customers deposited.

What is proof of security (PoSEC)? A newer disclosure showing the split between cold and hot storage and whether cold storage alone could cover all user assets if hot wallets were drained. Gate launched the first PoSEC framework on November 5, 2026.

Does cold storage make an exchange 100% safe? No. It protects against online theft, but not against insider abuse, bad access controls or a business that simply does not hold the reserves it claims. Check the audit, not just the headline number.

Should I keep my crypto on an exchange at all? For active trading, some funds on an exchange are practical. For long-term holdings, a personal hardware wallet — where you control the keys — removes exchange risk entirely.

This is market news and general information only, not financial advice. Join the conversation on Zimbuck — the finance social platform for traders and investors: https://zimbuck.com