1. What is Gate's Proof of Security standard?
Gate founder and chief executive Lin Han said on November 5 that the exchange is introducing Proof of Security, or PoSEC, a metric that asks whether an exchange could lose every internet-connected wallet it runs and still owe its customers nothing it cannot pay. Gate reports that its offline holdings equal 104.58% of customer assets, a figure that is still waiting on an independent audit.
The proposal arrives one week after the largest theft in the history of crypto hit Binance, and it is framed as a response to that episode. Han’s argument is that exchanges should be judged not only on whether they hold customer assets, but on how those assets are stored and whether a successful attack on trading infrastructure could reach them.
In an interview, Han described the underlying test as plain arithmetic that anyone can check. If the share of customer assets held in cold storage is at or above 100%, then the loss of the entire hot wallet leaves customers fully covered. If it falls below that line, a breach of the hot wallet translates directly into a shortfall for users.
2. How does the 100% cold-storage test work?
PoSEC compares two quantities: the assets an exchange keeps in cold storage, meaning wallets separated from the internet-connected systems that run trading and withdrawals, and the total amount the exchange owes its customers. When the first is at least as large as the second, the exchange passes in the sense Gate defines.
The distinction between hot and cold wallets is central to the idea. Hot wallets are connected to the internet so that an exchange can process deposits and withdrawals quickly, which also makes them the most exposed part of its infrastructure. Cold storage keeps keys and funds offline, which makes theft harder but makes moving funds slower. Most large exchanges hold a small working balance in hot wallets and the remainder offline.
Under Gate’s framing, the point is to ask a hypothetical question with a numerical answer: if the hot wallet were emptied tomorrow, would customers still be whole? Han said that Gate’s hot-wallet exposure is covered by what the exchange calls excess reserves, which is the amount it holds above the total of user assets.
The measure is deliberately simple. A single percentage can be recalculated by outsiders, compared across exchanges and tracked over time, which is the property Han emphasized when he said the test is arithmetic that anyone can check.
3. What are Gate's own PoSEC numbers?
Gate states that cold storage covers 104.58% of customer assets. According to the exchange, 88.26% of its total assets sit in cold storage and the remaining 11.74% are held in hot wallets. Its latest reported reserves total $8.69 billion, which Gate says amounts to 118.49% of customer assets.
Those figures are being reviewed in an independent audit, and until it is completed they remain the exchange’s own statements. Gate also disclosed that some of the assets counted as cold storage are not crypto at all: they include stocks and U.S. Treasuries held under independent custody.
That detail matters for anyone reading the 104.58% figure. The standard measures whether assets held away from trading systems could cover what customers are owed, and in Gate’s case part of that coverage comes from traditional securities rather than tokens kept in offline wallets. The custody arrangement is described as independent, which is the feature that keeps those holdings separate from the exchange’s operating systems.
The gap between the two headline ratios is also worth noting. Total reserves of 118.49% of customer assets are larger than the 104.58% cold-storage coverage because the reserves figure includes the hot-wallet portion as well. The difference between the two is the hot-wallet balance, and the cold-storage ratio is the more conservative of the pair.
4. Why was proof of reserves not enough?
Binance suffered the biggest crypto heist on record the previous week. The exchange had published proof of reserves, a type of report designed to show that it holds the assets it says it holds, yet some of the assets covered by that proof were among those stolen. Days afterward, Binance said it had set aside $6.34 billion to cover users’ funds.
Han used that sequence of events to draw a line between the two approaches. In his words, proof of reserves shows that assets exist, whereas PoSEC is meant to show how they are stored and whether they are protected. An exchange can pass the first kind of check on a given day and still be exposed if most of what it holds sits in wallets that an attacker can reach.
Proof-of-reserves reports are already published by Kraken, Binance and OKX. Gate’s position is that its new standard goes a step further by measuring whether assets located outside trading systems could cover customer balances even if hot wallets were stolen. The distinction is between a snapshot of total holdings and a stress test of how those holdings are distributed.
Put differently, a reserves report answers whether the money is there, while the PoSEC ratio answers what remains if the most exposed portion is gone. After an incident of the size Binance experienced, that second question is the one customers and institutions are more likely to ask.
5. What can PoSEC not verify?
Han acknowledged that the standard has limits. PoSEC does not check an exchange’s internal passwords, how its private keys are managed, or the access controls that govern who can authorize transfers. Those are the areas hackers frequently exploit, and a favorable ratio says nothing about how well they are defended.
The omission is significant because many large thefts begin with compromised credentials or poorly protected signing procedures rather than with a flaw in the wallet design itself. A pass on cold-storage coverage therefore describes the size of the potential loss after a breach, not the likelihood that a breach occurs.
This is consistent with how Gate presents the measure. It is offered as a way of limiting the damage from a successful attack, not as a guarantee against attacks. The exchange’s claim is narrower than a general security certification: that customers should not lose money if the online wallets are lost.
The distinction also explains why an independent audit matters. The ratio depends on accurate accounting of both the assets held offline and the obligations to customers, and only an outside review can confirm that the inputs to the arithmetic are correct.
6. Does the standard remove the speed-versus-security trade-off?
It does not, and Han said so directly, telling the interviewer that the standard does not necessarily eliminate the trade-off between security and fast withdrawals. His claim is that PoSEC makes the tension manageable rather than resolving it.
The tension is built into how exchanges operate. The more customer funds an exchange keeps offline, the safer they are from an online attack, but the longer it can take to replenish the hot wallet and honor large withdrawal requests. Keeping more funds in hot wallets does the reverse, speeding up payouts while enlarging the pool an attacker could target.
A published ratio gives exchanges and their customers a common reference point for that balance. An exchange that keeps cold storage above 100% of customer assets can hold a working balance online and still cover every user in a worst-case breach, because the excess reserves absorb the hot-wallet exposure.
Whether that arrangement is acceptable in practice depends on the user. Retail customers may value quick access, while institutions may prefer higher coverage and slower movement. By making the number public, Han said, users and institutions can decide what they are comfortable with.
7. How does PoSEC fit Gate's broader business?
The standard comes about a month after Gate rebranded around Gate Money, an app that combines trading, savings, asset conversion and card payments. Han told the interviewer in October that Gate has more than 60 million users and that the company wants to reach people who are not traders.
He framed the ambition in simple terms, saying Gate wants to offer the product to a wider range of customers. A publicly checkable security metric is a natural complement to that goal, since customers who use an exchange for savings and payments, rather than only for speculation, are likely to care more about whether their balances survive a breach.
Gate says it has been working on PoSEC for some time as part of its focus on cybersecurity, and that recent breaches made this an appropriate moment to publish it. The company’s timing places the standard in the middle of an industry-wide discussion about how exchanges should demonstrate resilience.
For a platform with a user base of that size, the incentive to differentiate on safety is considerable. A single, easily communicated ratio is more accessible to a general audience than a technical description of custody architecture.
8. What happens next for PoSEC?
The next milestone is the independent audit of Gate’s figures, which is underway. Its outcome will determine whether the 104.58% cold-storage coverage and the other ratios Gate has disclosed are confirmed by an outside party.
Gate also wants other exchanges and regulators to consider adopting the standard. Han stopped short of calling for a legal requirement, saying instead that once the number is public, users and institutions can decide what they are comfortable with. That position leaves adoption voluntary and places the pressure on market behavior rather than on rulemaking.
Whether competitors follow will show if the metric becomes a shared benchmark. Exchanges that already publish proof of reserves would need to add a disclosure of how much of their customer coverage sits offline, which would reveal their own hot-wallet exposure in a way a reserves report alone does not.
For now, PoSEC is a proposal from a single exchange, tied to an audit that has not yet finished. Its usefulness as an industry measure will depend on independent verification and on whether other platforms are willing to publish comparable figures.