How Does a CEX Typically Manage the Private Keys for Client Assets?

A CEX uses a combination of hot and cold storage solutions. A small portion of assets is kept in "hot wallets" (online, connected to the internet) for immediate liquidity.

The vast majority is secured in "cold storage" (offline, multi-signature wallets, often geographically dispersed) to minimize the risk of hacking. The exchange's security team manages the complex key generation and signing processes.