Hot, Warm and Cold Wallets: How Institutions Tier Storage

By the Guardian team Updated November 2026 5 min read

Quick answer. Hot wallets sign withdrawals automatically; warm wallets are online but sign only with human approval, to refill hot. Cold wallets keep keys offline and hold most client assets: 98% in Hong Kong, at least 95% in Japan.

Watch: Hot, Warm and Cold Wallets: How Institutions Tier Storage 1:36

Video transcript

Every exchange splits client assets by how fast they can move. Hot wallets pay, warm wallets refill, and cold wallets keep most assets offline.

Hot keys stay online and sign automatically, so the hot balance is roughly what an attacker can drain fast. Warm adds people. Cold adds distance.

Regulators now set the cold share. Hong Kong expects ninety eight percent, Japan at least ninety five, and Singapore at least ninety. Dubai sets no fixed share but wants audited transfers.

Cold storage alone is not enough. Bybit lost about one point five billion dollars during a routine transfer from a cold wallet to a warm one.

So each tier needs its own controls. Cap the hot float and enforce limits at the signer. Gate warm with a quorum and lock destinations. Keep cold keys air-gapped and split.

Rebalancing keeps each tier in its band. Set bands, sweep excess down, refill hot from warm after approval, replenish warm from cold in a ceremony, then reconcile.

Our illustrative policy, not a standard, fits Hong Kong's rule. Hot capped at one point five percent, warm signed two of three, cold never below ninety eight percent.

Guardian assesses custody, signing thresholds and cold storage ratios against the rules your license carries. Read the full article, or talk to Guardian about your wallet tiers.

Every exchange and custodian splits client assets by how fast they can move. The split caps what an attacker can take from an online system.

Several regulators now set the cold share. The moves between tiers matter too: Bybit lost about $1.5 billion during a routine transfer from a cold wallet to a warm wallet.

For where keys live inside each tier, see our private key management guide.

This article explains the technical and security side of the Hong Kong, Japanese, Singapore and Dubai custody rules it cites. It is not legal advice; confirm how they apply to you with counsel.

The Three Tiers Defined

Tier	Keys	How it signs	What it holds
Hot	Always online	Automatically, within limits	Float for withdrawals
Warm	Online, gated by approvals	Only after people approve	Buffer that refills hot
Cold	Kept offline	By quorum, in a ceremony	Most client assets

Hot keys are always exposed, so the hot balance is roughly what an attacker can drain fast. Warm adds people. Cold adds distance.

Dubai's VARA names all three tiers in its custody rules: "hot, cold and warm wallets."

Japan defines offline strictly. The FSA's supervisory guideline says a device "connected to the Internet even once" does not count as always unconnected.

What Regulators Require

Regulator	Text	Cold share	Also required
Hong Kong SFC	VATP Guidelines, para. 10.6	98% of client virtual assets	Documented transfers between storages
Japan FSA	Payment Services Act; Cabinet Office Order, Art. 27	At least 95%	Own crypto matching the online share
Singapore MAS	PS-G03, para. 3.4.4	At least 90% of assets in trust	Disclosure of non-cold holdings
Dubai VARA	Custody Services Rulebook, III.C.1	No fixed share	Independently audited transfer mechanisms

Hong Kong

The SFC's Guidelines say platforms should store 98% of client virtual assets in cold storage, except where the SFC permits otherwise case by case (para. 10.6(c)).

They should minimize transactions out of cold storage (10.6(d)). They should also document "the mechanism for the transfer of virtual assets between hot, cold and other storages" (10.6(f)).

Compensation cover follows the tiers: 50% of client assets in cold storage and 100% in hot and other storage (10.22).

The SFC's August 2025 custody circular adds air-gapped key generation for cold wallets; see our 25EC44 explainer.

The circular also quotes an initiative from the SFC's ASPIRe roadmap: "Explore adopting a dynamic approach to custody technologies and storage ratios." For now, 98% is the text.

Japan

The Payment Services Act requires exchanges to segregate client crypto and manage it by a protected method. The exception is a portion kept for convenience (Art. 63-11(2)).

The Cabinet Office Order limits that portion to the minimum necessary, capped at 5% of the yen value of client crypto (Art. 27(2)).

Keys for the rest must be kept on devices not always connected to the internet, or under equivalent measures (Art. 27(3)).

Exchanges must also hold their own crypto of the same type and quantity as the online client share, protected the same way (Act, Art. 63-11-2).

In April 2026 the FSA said cold wallets alone are not enough; see our FSA policy explainer.

Singapore and Dubai

MAS expects keys for at least 90% of customers' assets in trust to stay in systems with no internet or wireless connection (PS-G03, 3.4.4).

Firms should disclose when, and why, they keep customers' assets outside cold wallets (3.4.6).

VARA sets no percentage for custodians. They should choose storage through a risk-based analysis, and document how assets move between hot, cold and warm wallets (III.C.1).

Those transfer mechanisms should be subject to internal controls and audits by an independent third-party auditor.

Controls per Tier

Hot

Size the float to expected withdrawals, with a hard cap.
Run every payout through limits and allowlists at the signer.
Alert on unusual outflows, and halt automatically.

Warm

Require a quorum, approving on dedicated devices.
Allow transfers only to your own hot and cold wallets.
Lock the destination once approved, so it cannot change before signing.

Cold

Generate and keep keys on air-gapped devices.
Let no single person hold a whole key or backup (SFC 10.8(c)).
Store backups apart from the primary keys (SFC 10.8(d), VARA III.C.2(c)).
Show every transaction detail in readable form before signing.

Our withdrawal security guide covers the hot path step by step.

How Rebalancing Works

Rebalancing keeps each tier inside its band as deposits, withdrawals and prices move.

Set bands: a minimum and maximum hot balance per asset.
Sweep down: when hot passes its maximum, send the excess to warm or cold.
Refill up: when hot falls below its minimum, warm tops it up after approval.
Replenish warm: move funds from cold on a schedule, in a ceremony.
Reconcile: match chain balances to the ledger after every move.

Prices move the ratio too. Japan's cap is measured in yen value, so a rally in an online asset can breach it without any transfer.

If client crypto beyond the online allowance ends up outside protected storage, the FSA's guideline expects it fixed within one business day.

Moves out of cold are the exposed moment. Bybit's timeline says its loss came during a routine transfer from an Ethereum multisig cold wallet to a warm wallet.

So move out of cold rarely and in batches. Verify each transaction away from the screen that built it; our multisig vs MPC comparison covers why.

An Illustrative Tier Policy

The table below is an illustration, not a standard or industry data. We chose its numbers to fit Hong Kong's 98% rule.

Tier	Target balance	Hard cap	Approvals	Destinations
Hot	About one day of net withdrawals	1.5% of client assets	Automatic within limits	Whitelisted client addresses
Warm	One to three days of refills	Hot plus warm at 2%	2 of 3 operators	Own hot and cold wallets
Cold	Everything else	Never below 98%	3 of 5, in a ceremony	Own warm wallet only

Set your bands from your own withdrawal data, and test them against your busiest day.

How Guardian Helps

Guardian's regulatory assessments cover custody and safeguarding: segregation, key generation and storage, signing thresholds, cold storage ratios and recovery.

Each is assessed against the custody rules your license carries.

For fintechs, Guardian pentests the flows that authenticate users, authorize actions and approve withdrawals.

Its OpSec audit maps where keys live, who holds which share and what a quorum requires in practice.

Frequently Asked Questions

What is a warm wallet?

An online wallet whose keys sign only after human approval. Platforms use it as a buffer between cold storage and the hot wallet that pays withdrawals, so cold keys come out less often.

How much crypto must exchanges keep in cold storage?

It depends on the regulator. Hong Kong's SFC expects 98% of client virtual assets in cold storage, Japan caps online holdings at 5%, and Singapore's MAS expects at least 90%. Dubai's VARA sets no fixed share for custodians.

Is cold storage enough to prevent hacks?

No. Bybit lost about $1.5 billion during a routine transfer out of a multisig cold wallet. Hong Kong's SFC says recent weaknesses apply whatever custody technology is used, so the signing process needs controls too.

How often should hot wallets be rebalanced?

Whenever a balance leaves its band, with sweeps and refills triggered by thresholds. Check the cold share at least daily, since price moves alone can breach a cap measured in value, as Japan's is.

Sources

Check your wallet tiers against your rules

Guardian assesses cold storage ratios, signing thresholds and recovery against the custody rules your license carries, and tests the systems behind them.

Talk to Guardian Explore fintech security