How exchanges structure their wallets
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
Exchanges do not keep customer assets in a single wallet. The common design splits them between a hot wallet that funds withdrawals and cold storage that holds the bulk. The point is to cap the damage from a breach — though the details differ by operator and cannot be fully verified from outside.
Key points
- Hot wallets fund withdrawals; cold storage holds the rest
- The split exists to cap the blast radius of a breach
- Approval workflows and key splitting are part of the design
- Outsiders cannot fully verify the actual setup
Definition
The layered set of keys and addresses an exchange uses to custody customer assets, separated by purpose and network exposure into hot and cold wallets, with approval steps between them.
A hot wallet keeps keys on internet-connected systems so withdrawals can be processed quickly. That same exposure makes it the first target in a breach, which is why limiting the balance held there is the most basic control.
Cold storage keeps keys off the network. Signing requires a manual procedure, so it is slower, but a remote attacker cannot move the funds. In the usual design, the majority of customer assets sit on this side.
Many operators go further: multisig or threshold signatures so no single key can move funds, and approval workflows that split authority across several people. The goal is that neither one insider nor one compromised machine is enough.
Users, however, have limited means to confirm that any of this runs as described. Published material and third-party reports are useful context, but they describe a design — they are not a guarantee of safety.
Watch out for
- · A published design is not proof that it is followed in practice
- · While funds sit on an exchange, the exchange holds the keys, not you
- · For long-term holdings, consider self-custody as an alternative