The goal here is the normal operation, cold withdrawal, is very low risk.
If we ever did suspect our hot wallet keys were breached, we'd have to do that or else we would be stuck as you suggested.
“Cold” refers to it being entirely offline.
If an attacker can fool the people into getting funds out of the cold wallet, then they are available for an attacker to steal.
The only way to avoid the people being fooled is to have full auditing of every customer account balance. One needs to ensure that hot wallet + cold wallet >= all customers account balances.
Doing that auditing in a secure way is really hard.
* Several people would have to be compromised * The people are geographically diverse * Subzero will refuse to redirect funds to anything but a Square hotwallet. * And, they specifically built the Beancounter system for auditing of these accounts.
Sure but then you still have 12-48h to discover that they are being fooled.
There's no foolproof method, there will always be people involved and anything you could make will only make it better because it give you more people/time to realize the mistake. They decided that 2 persons and 12-48h is enough and I agree with that.
This actually seems like a significant risk. Cold storage is based on the idea that hot wallets are more easily compromised.
If someone does manage to compromise Square's hot wallet private keys, they can basically hold all cold storage funds hostage. Perhaps Square has some way to modify the allowed addresses, but that somewhat defeats the purpose of the restriction.