1. Why stratification?
The core contradiction is "online = available ≠ secure":
- 1.Users need their wallet to be online for withdrawals, allowing immediate signature transfers
- 2.But online = private keys can be accessed by attackers in a network accessible environment
The essence of tiering is: handling funds of different sizes with different availability = different security levels.
Roles in the second and third layers
- 1.Hot wallet: online, auto-signing, instant withdrawal response. Store daily withdrawal amounts for 1-3 days. If it gets breached, it's the loss of this layer of capital, but it doesn't affect the whole thing.
- 2.Wen wallet: semi-online, signatures require manual approval. Store the spare amount for 1-2 weeks. A transfer station from cold to hot.
- 3.Cold wallet: Completely offline, hardware signing device. Hold the bulk (70-95% of assets). Physical isolation, immune to cyberattacks.
The key isn't "how many layers are used," but "how much loss can be controlled when the hottest layer is breached." Each layer can only lose its own portion, not affect deeper layers.
3. How to set the capital ratio
There is no standard answer based on business size:
- 1.Small exchanges: Hot 10% / Warm 20% / Cold 70%
- 2.Large exchanges: Hot 5% / Warm 15% / Cold 80%
- 3.Personal/Small Institutional Wallets: Hot 0-5% / Warm 0% / Cold 95-100%
Look at two numbers:
Average daily withdrawal volume: Hot wallets must meet withdrawal needs every N days
Withdrawal peaks: Avoid triggering emergency collection when hot wallets run out of funds during large single-day withdrawals
4. Automatic Collection Strategy
The third floor is not static; funds must flow automatically between layers:
- 1.Hot → Warm: If the hot wallet falls below the threshold, automatically replenishes from the warm wallet (no manual required).
- 2.Warm → Cold: Warm wallets above threshold are consolidated into cold wallets (manual approval)
- 3.Cold → Warm: When the warm wallet is insufficient, replenishes from the cold wallet (multiple people sign and approve).
The key is that thresholds should be configurable so that business volume can be easily adjusted when needed.
5. Approval and Abnormal Fuses
Cross-layer fund transfers must follow an approval process:
- 1.Small amount collection: Automatically executed (within program limits)
- 2.Medium quota collection: Individual approval
- 3.Large Collection: Multiple parties sign and approve
- 4.Abnormal situations: address changes, amounts exceeding expectations, abnormal operation frequency → immediate circuit breaker + manual intervention
Fuse is more important than "preventing abnormalities." Abnormalities are inevitable, but losses must be manageable. This is the deepest wisdom of layered architecture.
