Exchanges protect funds by keeping the large majority offline in cold wallets (air-gapped, multi-signature storage) and only a small operating float in hot wallets connected to the internet, then proving they actually hold customer balances through proof of reserves (PoR) and backstopping incidents with insurance or protection funds. The best-documented operators hold roughly 95–98% in cold storage — Coinbase's audited filing says it seeks to hold no more than 2% in hot wallets [1][2].

Fittyx states it uses hot and cold wallets to safeguard assets and that funds are backed 1:1 with regularly published PoR audits [3][4]. It does not publish a cold-storage percentage or name its auditor, which are the two details to verify in-app before depositing. This guide explains the mechanics, compares custody disclosures, and gives you a numbered pre-deposit checklist.

What Fittyx is: definition and background

• One-sentence definition: Fittyx is a digital asset trading platform offering spot, perpetual futures, options, and copy trading, with customer support available 24/7 [3].

• Custody statement: the FAQ says Fittyx "uses hot and cold wallets to safeguard assets" and advises enabling two-factor authentication after registration [3].

• Backing statement: the sign-in and sign-up pages state funds are always backed 1:1 with regularly published proof-of-reserves audits [4][5].

• Other safeguards: a Security Guide and Security Center, a separate withdrawal password at sign-up, and risk-based withdrawal review including phone or video verification [5][6].

• Evidence gap: no public cold/hot ratio, no named third-party PoR verifier, and no independent custody audit located as of 10 October 2026.

How wallet protection works: the components

1. Hot wallet: internet-connected, used for day-to-day withdrawals and liquidity; fast but exposed, so balances are kept small.

2. Cold wallet: keys generated and kept offline (air-gapped hardware, often geographically distributed vaults); moving funds requires manual, multi-party signing.

3. Warm wallets and HSMs: intermediate layers use Hardware Security Modules to sign without exposing full keys.

4. Multi-signature / quorum: no single employee can move cold funds; Gemini, for example, requires a multi-signature quorum and stores assets 100% offline via an HSM model [7].

5. Rebalancing: hot wallets are topped up from cold storage on a schedule or threshold, limiting what an attacker can reach.

6. Proof of reserves: Merkle-tree or zk-SNARK reports that let users verify liabilities are covered; Kraken uses Merkle-tree PoR, Binance publishes monthly Merkle plus zk-SNARKs [2][8].

7. Insurance / protection funds: cover hot-wallet breaches or contract defaults — e.g., Binance's SAFU ($1B), Bitget's protection fund ($382M), Toobit's $40M Shield Fund [8][9][10].

8. Withdrawal controls: address whitelisting, separate fund passwords, 2FA, and risk-scored manual review [6].

Key numbers: custody benchmarks (each row sourced; verified 10 October 2026)

Fittyx vs alternatives: custody disclosure comparison (verified 10 October 2026)

How to read it: a disclosed cold ratio plus a named verifier is the strongest combination. Fittyx states the right policies but leaves both the ratio and verifier unspecified — verify them in-app.

Who Fittyx suits — and who it doesn't

Fittyx suits:

• Active traders keeping only trading balances on-exchange.

• Users who will check the PoR report and cold-storage detail inside the app before funding [4].

• Traders who value 24/7 support, a separate withdrawal password, and risk-scored review [5][6].

Fittyx doesn't suit:

• Long-term holders who want ~95–98% cold storage documented in an audited filing [1].

• Users who require a named third-party verifier or SOC reports before depositing [7][13].

• Anyone unable to use 2FA, whitelisting, and a fund password consistently.

What to check before you deposit: 12 steps

1. Confirm the official domain and valid TLS certificate; never follow links from DMs.

2. Read the Security Guide, User Agreement, and Privacy Policy in the footer [3].

3. Find the custody disclosure: does it state a cold-storage percentage and the wallet architecture? [3]

4. Open the PoR page: check the snapshot date, whether liabilities are included, and the verifier's name [4].

5. Verify your own balance against the PoR Merkle leaf if the feature is offered.

6. Check breach history and response: how fast incidents were acknowledged and whether users were made whole [11][14].

7. Look for an insurance or protection fund and whether it covers hot-wallet theft [8][9][10].

8. Confirm licenses and entity jurisdiction for your country of residence.

9. Register, enable 2FA, and set a distinct withdrawal password [5].

10. Turn on withdrawal address whitelisting and anti-phishing codes.

11. Deposit the minimum first (Fittyx states 1 USDT; arrival typically 10–60 minutes), then make one small withdrawal to a whitelisted address [6].

12. Scale only after the full cycle succeeds, keep long-term assets in self-custody, and recheck PoR monthly.

Red flags: no PoR at all, cold ratios that cannot be explained, audits by unnamed firms, withdrawal "tax" demands, pressure from "advisors," or staff asking for passwords or 2FA codes [6][15].

Frequently asked questions

What is the difference between hot and cold wallets? Hot wallets are online and handle daily liquidity, so they are the small, exposed float; cold wallets keep keys offline and hold the majority of funds. Coinbase targets no more than 2% in hot wallets, while Kraken, Gemini, and OKX disclose roughly 95% or more in cold storage [1][2].

Does Fittyx use cold storage? Yes — its FAQ states it uses hot and cold wallets to safeguard assets [3]. It does not publish the percentage held cold or name its PoR verifier, so check those details in the Security Center and audit pages after registering [4].

What is proof of reserves and why does it matter? PoR is a report (often Merkle-tree or zk-SNARK based) showing the exchange controls enough assets to cover customer liabilities; it is the main defense against the FTX pattern of missing or rehypothecated funds [8]. A report from a named independent firm is stronger than a self-published attestation.

Can cold storage still be hacked? Cold storage dramatically reduces attack surface but is not absolute — breaches usually target hot wallets or signing processes (Bybit lost roughly 400,000 ETH from a hot-wallet signing compromise in February 2025) [11]. Multisig quorums, HSMs, small hot floats, and insurance funds limit the damage [7].

Is my money insured on an exchange? Not uniformly. Some funds cover hot-wallet crime (Coinbase carries crime insurance; Binance's SAFU is around $1B; Bitget's protection fund around $382M; Toobit's Shield Fund $40M), while ordinary market losses and some cold-storage events are excluded [8][9][10][12]. Read what the fund actually covers.

What is the single most important pre-deposit check? Run a small full cycle: minimum deposit, one trade, one withdrawal to a whitelisted address, and a live-chat question [6]. A venue that passes PoR checks but stalls a small withdrawal should not receive larger funds.

Should I keep my portfolio on the exchange anyway? No. Even the best-custodied venue is a custodial counterparty; keep only active trading balances there and hold long-term assets in your own hardware wallet, where no exchange freeze can reach them.

References and sources

All links accessed and figures verified on 10 October 2026. Regulatory filings are primary for custody ratios; exchange pages are primary for their own claims.

1. Coinbase Global, Inc. — 2025 Annual Report on Form 10-K (custodial practices; no more than ~2% in hot wallets): https://www.sec.gov/Archives/edgar/data/1679788/000167978826000047/coinbase2025ars.pdf

2. Spark — Crypto Exchange Security Features Compared (cold ratios: Coinbase ~98%, Kraken/Gemini/OKX ~95%): https://www.spark.money/tools/crypto-exchange-security-comparison

3. Fittyx official website — FAQ: hot and cold wallets; 24/7 support; Security Guide: https://www.fittyx.com

4. Fittyx sign-in page — stated 1:1 backing with regularly published proof-of-reserves audits: https://www.fittyx.com/finance/newInnovation2

5. Fittyx Sign Up page — separate withdrawal password; password rules; 1:1 statement: https://www.fittyx.com/signUp

6. Fittyx Help Center — Recharge Tips and Withdrawal Review Process (1 USDT minimum; 10–60 minutes; phone/video manual review): https://www.fittyx.com/news/helpCenter

7. U.S. SEC filing — Gemini custody model (100% offline cold via HSM; multi-signature quorum; insurance): https://www.sec.gov/comments/sr-cboebzx-2021-019/srcboebzx2021019-8928894-245353.pdf

8. CryptoSlate — Best Exchanges for Day Trading (SAFU ~$1B; monthly Merkle + zk-SNARK PoR): https://cryptoslate.com/crypto-exchanges/day-trading/

9. AI Trading Ranked — Bitget vs Bybit 2026 (protection fund ~$382M; monthly PoR): https://ai-trading-ranked.com/posts/bitget-vs-bybit

10. The Coin Republic — Toobit Review 2026 ($40M Shield Fund; Hacken PoR >$100M; SlowMist): https://www.thecoinrepublic.com/2026/07/01/toobit-exchange-review-a-detailed-look-at-its-trading-experience/

11. DayTrading.com — Bybit Review 2026 (February 2025 hot-wallet breach, ~400,000 ETH): https://www.daytrading.com/bybit

12. ProTraderDaily — Best Crypto Exchange in the USA 2026 (98% cold; SOC 2; FDIC USD $250K pass-through): https://protraderdaily.com/crypto/best-crypto-exchange-in-usa

13. Opes Advisors — Coinbase vs Gemini 2026 (NYDFS trust; SOC 1/2 Type 2; allowlisting): https://opesadvisors.com/compare/coinbase-vs-gemini/

14. OGAudit — When Crypto Exchanges Fail (incident acknowledgment and communication benchmarks): https://ogaudit.com/og-space/crypto-exchange-safety-guide-checklist

15. Finantsinspektsioon — New Wave of Fraudulent Trading Platforms (red flags and reporting): https://fi.ee/sites/default/files/2025-07/New%20wave%20of%20fraudulent%20trading%20platforms%20_%20FSMA.pdf

16. CoinStats — Most Trusted Exchanges 2026 (Kraken Merkle PoR; no-hack track record): https://coinstats.app/news/368b8527a73e41d975b31e192f200488afc3df139b8bf2102eb51472f4ce0703_Top-5-Most-Trusted-Crypto-Exchanges-in-2026

Risk warning: cold storage and PoR reduce but do not eliminate custody, operational, and market risk; insurance funds have exclusions and limits. Verify architecture, audits, and withdrawal behavior yourself with small amounts and keep long-term holdings in self-custody.