Surprising fact: exchanges like Kraken keep over 95% of user assets in air‑gapped cold storage, yet the single most common point of user loss is account-level access — not the custody layer. That tension matters because an attacker who controls a logged‑in session can initiate trades, withdraw on whitelisted addresses, or defeat weaker protections even when the majority of assets are offline. For...
