Coinbase Says 99% of Customer Crypto Is Offline and Out of Hackers’ Reach
Coinbase reassured customers that it wasn't affected by the Binance hack and keeps more than 99% of customer assets in offline cold storage.
In a blog post Wednesday, the U.S. exchange said it wasn't affected by last week's hack of Binance, in which attackers drained about $6.4 billion from the rival exchange's hot wallets. Coinbase said it keeps more than 99% of customer assets in cold storage, meaning offline wallets that can't be reached over the internet.
The Binance incident "has understandably left customers asking" how Coinbase guards against a similar attack, the post said. The exchange detailed several layers of protection to reassure customers that what happened at Binance can't easily happen there.
Security Measures
Private keys for Coinbase's cold wallets are split into pieces and never fully reassembled, even when signing transactions. No single employee has standing access to the hot-wallet signing service, and strict limits cap how fast funds can move from cold to hot wallets.
The exchange can trigger "kill switches" that take signing keys offline entirely. Coinbase said it assumes employees will be targeted by phishing, so its controls are designed so that a stolen password, session or device can't be used on its own, and sensitive actions require multiple approvals.
Customer Assets
Coinbase said customer assets are held 1:1 and aren't lent out unless customers direct it to. The company reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30.
The exchange flagged artificial intelligence as a fast-changing security threat and pledged further security investment. This comes after Coinbase disclosed in May 2025 that criminals had bribed overseas customer support agents to steal personal data on less than 1% of its monthly transacting users.
Last week, Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a "small subset" of customers, though funds weren't affected. The Binance theft, attributed to North Korea's TraderTraitor group, has rattled the industry, with similar hacks occurring at Brazil's Mercado Bitcoin ($40 million) and French bank Crédit Mutuel Arkéa ($133 million).
Related
