FudPanic

All articles

Coinbase says over 99% of customer assets are in cold storage after Binance hack

Coinbase says it was unaffected by the Oct. 29 Binance hack of about $6.3B and that over 99% of customer assets sit offline, a figure it reports itself.

Coinbase says more than 99% of customer assets are held in offline cold storage. The exchange made the claim on Nov. 4, about a week after the Oct. 29 hack at Binance. According to Bitcoin.com News, Coinbase posted the statement on X and published a blog post titled "How Coinbase Protects Customer Assets."

Coinbase also said its systems and customer funds were not affected by the Binance incident, as reported by The Block, Decrypt and Wu Blockchain.

What Coinbase says it does

Per Bitcoin.com News and Wu Blockchain, Coinbase keeps only enough in its internet-connected hot wallets to cover withdrawals and transfers. Balances are rebalanced as customer demand changes, and excess funds move into offline custody. Its institutional Custody vault is entirely cold and segregated onchain, according to Bitcoin.com News and Cryptopolitan.

Coinbase describes several layers of control. Private keys are split into separate pieces and are never fully reassembled, even when a transaction is signed. Automated anomaly detection and transfer limits can pause suspicious withdrawals while security staff investigate. Kill switches can disable signing entirely, and affected systems cannot resume until investigators confirm they are safe.

Bitcoin.com News adds that changes to hot-wallet infrastructure require approval from multiple employees. Staff access is limited through temporary privileges, phishing-resistant authentication and extra approvals for sensitive actions. Coinbase also said customer assets are held 1:1, remain customer property, and are not lent or used without customer instructions.

The Binance incident and open questions

Reports differ slightly on the size of the Binance loss. Bitcoin.com News cites $6.34 billion, The Block and Cryptopolitan say about $6.3 billion, and Decrypt puts it at $6.4 billion. Bitcoin.com News says Binance described a social engineering campaign that compromised employee devices and reached its internal wallet-signing infrastructure. It also says Binance called the theft the largest reported from a crypto exchange, and that Binance temporarily suspended withdrawals.

Both Bitcoin.com News and Cryptopolitan stress that Coinbase's figures are self-reported. Bitcoin.com News says the exact split between hot and cold storage has not been independently established by third parties. Cryptopolitan says the safeguards and assurances were not independently verified.

Cryptopolitan also raises a broader point. Keeping assets offline does not by itself stop attackers from getting fraudulent transfers approved. In the Binance case, the attackers reached the signing infrastructure rather than simply finding funds in a hot wallet.

Why it matters for traders

For traders, the disclosure is a reminder that exchange custody practices differ and are mostly visible only through the exchange's own statements. A high cold-storage share limits what a hot-wallet breach can reach. The sources suggest the harder question is how withdrawals are authorized and how quickly an exchange can halt signing.

Worth watching are any independent verification of Coinbase's figures, such as third-party audits or proof-of-reserves style reporting. Also watch for further detail from Binance on how the attackers got in and how withdrawals resume. The sources do not report any impact on Coinbase's own operations.

Sources

Written with AI assistance from the sources above and checked against them. Not investment advice.