A cold reserve for a crypto exchanger is the crypto that sits offline and never touches daily operations. The question isn't whether you need one — you do. It's how much to lock away and how often to pull from it so one signer's mistake doesn't sink the business. Short answer below, then the numbers and the process.
Why you need two wallets, not one
Two wallets exist so a single incident can't wipe out the whole business. The hot wallet handles live payouts around the clock — convenient, but exposed if the server gets compromised. The cold wallet sits offline, out of reach for a remote attacker, though pulling funds out of it takes real time.
Picture an exchanger that keeps everything hot for speed: one leaked API key and the balance is gone in minutes. With a cold reserve in place, an attacker gets, at best, the operating slice — not the business.
How much goes cold, how much stays hot
A workable rule: keep on the hot wallet roughly 1-3 days of typical payout volume, move the rest into cold storage.
- average daily payout volume
- peak days — rate swings, promo periods
- how fast you can top up hot from cold
- a buffer for network delays
Get this ratio wrong in either direction and you either sit exposed or keep clients waiting on withdrawals.
Hardware, multisig, or MPC — picking a cold setup
Each option trades convenience for resilience differently. A single hardware wallet is cheap and simple, but it's a single point of failure if that one device or signer is unavailable or compromised. Multisig (say, 2-of-3) survives one compromised key, though coordinating several signers slows down every transfer. MPC splits the signing process without ever assembling one key in one place — faster to sign than multisig, but you're trusting the provider's own security.
None of these removes the human risk: if your three multisig signers sit in the same office and sign on request, it's multisig on paper, not in practice.
The rotation routine: who signs, and how often
Rotating the reserve isn't a one-time setup — it's a process with dates and named roles.
- who initiates a cold-to-hot transfer
- at least two independent signers
- a signing window — business hours, not 3 a.m.
- a log of every move: amount, reason, approver
One exchanger we know of moved reserves every Thursday, regardless of demand — and got through a year of sharp rate swings without a single scramble, because the hot balance refilled on a predictable schedule.
Common mistakes in reserve setup
- Keeping too much hot “for speed” — a single, obvious target.
- Trusting the cold wallet to one person with no backup signer.
- Never testing seed-phrase recovery — it exists, but nobody checked the backup actually restores.
- Storing every signer's key in one physical location — a fire or theft settles it in one move.
- Rotating on a whim instead of a fixed schedule.
Conclusion
A cold reserve isn't a safe you open once and forget about. It's a procedure — how much, who, when, under what conditions. Skip the procedure and panic eventually writes one for you. If you're launching your own exchanger and don't want to improvise a custody setup from spare parts, there's a wallet built with reserve logic already in it — iEXWallet — no middleman fee, no build from scratch.
