Glossary
Cold storage
Holding crypto in wallets whose private keys are never connected to the internet, so they cannot be reached by a remote attacker.
An exchange has to keep some assets in hot wallets — online, ready to process withdrawals in seconds. Everything it does not need for that sits in cold storage: keys generated and kept on hardware that never touches a network, moved only through deliberate, multi-person procedures. Every major exchange breach on our record — Binance 2019, KuCoin 2020 — hit hot wallets. Bybit's 2025 loss was unusual precisely because it came from a cold-wallet transfer process, which is why it was so large and so widely reported.
The proportion held cold is therefore a security claim worth checking, and one exchanges rarely quantify. We record what each venue states on its exchange data sheet and score it in the security sub-score, weighting an attested figure above a marketing sentence.
For your own holdings the same logic applies with less ceremony: a hardware wallet is cold storage, and for any balance you would be unhappy to lose it removes the exchange from the risk entirely. The exchange is for trading and for moving fiat; it is not a vault.
Where this shows up
- Kraken data sheet
- Bybit data sheet
- KuCoin data sheet
- Exchange safety scores
- Kraken vs Binance: safety vs cost
Frequently asked questions
Does cold storage make an exchange hack-proof?
It makes the cold portion unreachable remotely. Hot wallets remain exposed, and the process of moving funds out of cold storage is itself a target, as the 2025 Bybit incident showed.
Should I keep crypto on an exchange at all?
For amounts you are actively trading, yes. For long-term holdings, a hardware wallet you control is safer than any custodian.
Related terms and pages
Related terms
- Proof of reserves
A published cryptographic or audited demonstration that an exchange holds the assets its customers have deposited.
- Two-factor authentication (2FA)
A second proof of identity at login and withdrawal beyond the password — an authenticator app, a hardware key, a passkey or an SMS code.
- Insurance fund
A pool of assets an exchange sets aside to cover losses — either customer losses after a security incident, or liquidation shortfalls on derivatives, depending on the fund.
More from the glossary