How to Configure Hot and Cold Wallets on a Crypto Exchange: Operator Checklist

A hot wallet breach can empty client balances in minutes if most funds sit online. Before you open withdrawals, configure hot and cold wallets: pick self-custody, a qualified custodian, or a hybrid; size hot / warm / cold with outflow-based caps; run a dual-control key ceremony; then wire daily recon, segregation, and a go-live checklist. You leave with a signed policy, not a retail wallet explainer.

TL;DR / Quick take: Keep only short-window withdrawal demand in hot; use warm as a controlled buffer; park the bulk in cold with multi-party access. Institutional guides often cite hot about 2-10%, warm 10-20%, cold 70-90% – prefer hot = projected outflows x replenish lag + buffer. Ban single-key admin wallets for client funds. Go live only after incident, insurance, and vendor due diligence gates pass.

Exchange custody is not a consumer hardware wallet. You need continuous withdrawals, multi-asset support, and accountability for client assets. Pair this with how to start a crypto exchange and the compliance checklist for founders. White-label stacks can ship wallet modules and policy hooks – you still own ratios, ceremony, and go-live gates.

1. Define custody model: self-custody vs qualified custodian vs hybrid

Hot wallet = keys that sign quickly for withdrawals (day cash drawer). Cold storage = keys offline or air-gapped (vault). Warm = middle tier not glued to the trading UI. MPC (multi-party computation) splits key material so the full private key is never rebuilt in one place. Multisig needs M-of-N keys to approve a spend. HSM = hardware security module that signs without exposing the key.

1. Self-custody – your team runs hot, warm, and cold. Fast iteration; you carry full key risk.
2. Qualified / third-party custodian – licensed custodian holds most cold reserves. Stronger external controls; slower cold moves.
3. Hybrid – common at scale: hot signing in-house for latency; majority cold with a custodian or MPC vendor.

Model	Best when	Main trade-off
Self-custody	Early MVP, dual-control culture	You own every key incident
Qualified custodian	Licence / insurance buyers demand it	Cold refill latency, vendor lock-in
Hybrid	SLA withdrawals plus cold floor	Two stacks to monitor

Map the model to your licence early. Hong Kong SFC VATP Terms require licensed platforms to store 98% of client virtual assets in cold storage – a jurisdiction example, not a global default. MiCA, VARA, and MAS-style regimes push the same triad: segregate client vs firm assets, keep auditable records, prove reserves on demand.

Do this: write a one-page custody model memo (who holds cold, who signs hot, which licence floor). Do not launch with a single shared admin seed for client funds.

2. Size hot / warm / cold ratios and withdrawal velocity limits

Static “80/20” slogans break under real volume. Prefer the institutional formula: target hot = projected net outflows x replenish lag (often 24-48h) + buffer (guides cite ~15% for fees and volatility). Encode ceilings in a policy engine – rules that block or escalate moves above thresholds.

Tier	Typical guide band	Job
Hot	Often 2-10%; many venues aim ≤5% with auto-refill; some cite 5-15% or 1-5%	Pay short-window withdrawals
Warm	Often 10-20% (some models ~15-25%)	Buffer not open to trading UI
Cold	Often 70-90%; custodians often ≥85%; HK VATP example 98%	Bulk offline multi-party access

Cautionary pattern: overfunding hot to ~22% because cold refill was manual; after automation and a hard ceiling, hot fell under 9% without hurting SLA.

1. Measure 7- and 30-day net outflows by asset and chain.
2. Set hot ceiling from the outflow formula; hard-cap above it.
3. Define warm buffer and cold floor (licence floor if any).
4. Write velocity limits – per address, hour, day; higher quorum above thresholds.
5. Allowlist treasury hot↔warm↔cold addresses and turn on anomaly alerts.

Workflow: Outflow forecast → hot ceiling → warm refill trigger → cold multi-party move → audit log.

Do this: publish ratios and velocity caps in a dated policy with owners. Do not keep more than 10% in hot forever because refill is inconvenient.

3. Key ceremony, dual-control approvals, and access logging

Institutional pattern: MPC or HSM for hot signing latency; HSM / multi-party for cold; multisig or HSM multi-party for warm. Multisig is transparent on-chain but slower for high-volume withdrawals. MPC keeps shares separate and can rotate without moving assets.

1. Run a written key ceremony – generate offline where cold requires it; record attendees, tools, hashes, time.
2. Split roles – initiator ≠ approver ≠ auditor (dual-control).
3. Distribute shards or devices across people and geographies.
4. Test recovery on a dry-run wallet before client funding.
5. Enable immutable access logs for every sign, export, and policy change.

Bake into cold ops: air-gapped signing, multi-party auth, geographic key distribution, access logging, rehearsed recovery. Confirm your stack exposes quorum and policy hooks – see white-label vs build and core modules explained.

Do this: fund production only after a recovery drill and dual-control sign-off. Do not store seeds in chat, shared drives, or one founder phone.

4. Daily reconciliation and client-asset segregation controls

Segregation means client coins are not mixed with company treasury for ops or market-making. Omnibus pools deposits for efficiency; per-user deposit addresses make attribution clearer. Either way, the ledger must prove who owns what.

1. Tag every wallet as client, firm, or fee.
2. Reconcile daily hot/warm on-chain balances vs client liabilities.
3. Escalate breaks same day for material gaps.
4. Keep PoR readiness – proof of reserves packs on demand.
5. Freeze immutable audit logs for withdrawals, refills, cold access.

Do this: put daily recon on the ops calendar with a named owner and backup. Do not treat week-old spreadsheets as production control.

5. Go-live custody ops checklist (incident, insurance, vendor DD)

Open withdrawals only when every line below is signed.

• Custody model memo approved and mapped to licence floor
• Hot ceiling, warm buffer, cold floor with outflow-based sizing
• Velocity limits, address allowlists, anomaly alerts live
• Key ceremony done; shards split; dual-control roles named
• Recovery drill passed on non-production funds
• Single-key admin wallets banned for client assets
• Client vs firm segregation coded in ledger and wallet tags
• Daily reconciliation + break escalation path tested
• Incident runbook: hot drain, key compromise, stuck cold ceremony
• Insurance / compensation arrangement reviewed for your regime
• Vendor DD: SOC 2 / ISO 27001 / SLA for custody, MPC, or HSM providers
• Quarterly cold-access drill on the calendar
• Founder + security + compliance sign-off dated before first public withdrawal

Go-live gate: Policy signed → ceremony + recovery OK → recon + segregation live → incident/insurance/vendor DD clear → open withdrawals.

Do this: treat any unchecked line as a launch blocker. Do not open withdrawals and “finish custody later.”

What to do next

Lock the model, write outflow-based ratios and velocity caps, finish the key ceremony, then turn on daily recon and walk the go-live checklist. More guides on the White Label Exchange blog. Need wallet modules and policy hooks? Explore White Label Exchange solutions.

Reviewed by: White Label Exchange Editorial (practitioners in white-label exchanges, exchangers, P2P, and custody-ready launch stacks).
Data integrity: tier bands and MPC/multisig patterns cite institutional guides (Liminal Mar/Jul 2026, Cregis, Interexy, ChainUp, Nadcab, Cobo). HK 98% cold cites SFC VATP Terms. Dynamic hot sizing follows ChainUp-style outflow x lag + buffer. RU Wordstat proxies checked 2026-08-25; English primary volumes were not invented.

Frequently asked questions

What hot-to-cold ratio should a new exchange use?

Size hot for 24-48h of projected withdrawals plus a buffer, then enforce a hard ceiling. Guides often land near hot 2-10%, warm 10-20%, cold 70-90%. If your licence sets a cold floor (HK VATP example: 98%), meet that floor first.

MPC vs multisig for exchange custody?

Use MPC or HSM-backed signing where hot latency matters and you want threshold signing without reconstructing a full key. Use multisig or HSM multi-party for slower cold moves with on-chain transparency. Many operators mix both. Ban single-key wallets either way.

How to segregate client wallets from operational funds?

Tag wallets as client, firm, or fee. Keep MM and opex inventory out of client pools. Reconcile on-chain balances to liabilities daily and escalate breaks the same day. Omnibus is fine only if the ledger proves ownership line by line.

How much should stay in the hot wallet?

Prefer ≤5% with automated warm refill when volume allows; treat >10% hot as high-risk unless you have a written temporary reason and a rebalance date. Automate refill instead of overfunding hot.

What belongs on the go-live custody checklist?

Include model memo, ratio/velocity policy, ceremony + recovery drill, dual-control, segregation + daily recon, incident runbook, insurance review, vendor DD, quarterly cold drill, and dated sign-off before public withdrawals.

Do white-label exchanges include custody controls?

Many stacks ship wallet modules, quorum hooks, and ledger tags – you still define ratios, ceremony roles, and go-live gates. Ask vendors to demo policy ceilings and audit logs before accepting “custody included.”