How crypto exchanges store your coins: hot wallets, cold storage, custodians and the rules

When you buy crypto on an exchange, you usually don’t hold the keys. The exchange does. How it stores those keys decides how exposed your coins are to hackers, and the October 2026 Binance hack, which TRM Labs linked to Binance’s hot wallet signing system, is a reminder of why it matters.

This guide explains hot wallets, cold storage and custodians, what regulators in Canada, the UK and New York require, and the questions to ask your platform.

Hot wallets and cold storage

• A hot wallet is connected to the internet. TRM Labs describes it as a wallet that an exchange uses to process customer withdrawals.
• Cold storage keeps the private keys offline, for example on dedicated devices. It’s harder to attack but slower to use.

Exchanges need some crypto in hot wallets so withdrawals don’t take days. The rest can sit in cold storage. The trade-off is the same as for individuals. See hot vs cold wallets.

Why hot wallets are targeted

Hot wallets are connected and active, so they’re the natural target. In the Binance case, TRM said wallets on ten different blockchains, with different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. Its assessment was that the attacker had gained the ability to make Binance’s signing system sign transactions of its choosing. Binance itself said it had found no evidence of a private key leak. See the $6.3 billion Binance hack.

Omnibus wallets: your coins aren’t in your own address

Most exchanges don’t keep a separate blockchain address for each customer’s holdings. They use omnibus wallets holding many customers’ crypto, and track who owns what in their internal ledger. That’s why proper record-keeping and segregation rules matter so much. See proof of reserves explained.

The rules in Canada

Canadian crypto platforms operate under decisions from securities regulators. The Ontario Securities Commission’s March 2026 decision on Newton shows what’s required. Newton must:

• hold not less than 80% of the total value of client crypto with Acceptable Third-Party Custodians, unless the regulator approves otherwise;
• hold client crypto in trust for clients, in omnibus accounts separate from its own assets and its custodians’ assets;
• give the regulator a quarterly list of the blockchain addresses holding client crypto, including all hot and cold wallets, and details of any cybersecurity incidents.

The decision says that, for operational purposes, up to 20% of client crypto may be held in hot wallets secured by the technology provider Fireblocks, used for deposits, withdrawals and trade settlement. Its custodians are regulated trust banks or trust companies and carry insurance against hacks, key theft and insider theft. Fireblocks has insurance of US$30 million in aggregate for thefts from hot wallets it secures, shared among its customers.

See Canadian crypto platforms joining CIRO.

The rules in the UK from 2027

The FCA’s new regime starts on 25 October 2027. Its custody rules (CASS 17, in PS26/11) require firms safeguarding client crypto to:

• hold it on trust for clients, and keep records showing each client’s crypto separately from other clients’ and from the firm’s own;
• reconcile their records regularly;
• protect the “means of access”, such as private keys or parts of keys, against the risks of inoperability, inaccessibility, loss, fraud and irrecoverability, throughout its life cycle.

The FCA says these rules cover the use of “hot” or “cold” devices to store the means of access, written records of keys, and splitting keys into shards held by different people. Its guidance asks firms to consider vulnerabilities to hacking, theft by their own staff, and “single point of failure” risks such as concentrating access in too few people or devices.

See the UK’s crypto trading rules from 2027.

The rules in New York

New York’s Department of Financial Services updated its custody guidance on 30 September 2025. It expects custodians to:

• segregate customer crypto from their own, both on-chain and in their internal ledger, using either separate wallets per customer or omnibus wallets containing only customer crypto;
• keep records showing each customer’s interest at all times, and be able to show reconciliation between their books and on-chain activity;
• not use customer crypto for themselves, for example to secure loans or extend credit;
• get DFS approval before using a sub-custodian;
• disclose clearly how they hold and account for customer crypto.

See New York’s BitLicense.

Questions to ask your exchange

1. What share of customer crypto is in hot wallets, and what’s in cold storage or with custodians?
2. Who is the custodian, and is it regulated?
3. Is my crypto held in trust or segregated from the company’s own assets?
4. Is there insurance for hot wallet theft, and how much?
5. Does the platform publish proof of reserves?
6. If the platform is hacked, what does it say about covering losses? See when a crypto exchange is hacked, who pays?

If you don’t need to trade often, holding long-term crypto in your own wallet removes exchange risk, though it makes you responsible for your keys. See seed phrase security.