Coinbase said it was not affected by last week's hack of Binance and that more than 99% of customer assets are held in offline cold storage, according to a blog post on Wednesday. The U.S. exchange outlined the controls it uses to protect customer funds, aiming to reassure users that a similar attack is unlikely.
Cold Storage and Key Management
Coinbase said it moves funds into internet-connected hot wallets only as customers need them. Private keys for cold wallets are split into pieces and never fully reassembled, even when signing transactions, and no single employee has standing access to the hot-wallet signing service.
Withdrawal Limits and Kill Switches
The exchange imposes strict limits on how quickly funds can move from cold to hot wallets. Unusual withdrawal spikes are held until staff review them. Coinbase can also trigger "kill switches" that take signing keys offline entirely.
Insider Threat Protections
Coinbase said it assumes employees will be targeted by phishing, so its controls are designed so that a stolen password, session, or device cannot be used on its own. Sensitive actions require multiple approvals. That focus on insiders carries weight: in May 2025, Coinbase disclosed that criminals had bribed overseas customer support agents to steal personal data on less than 1% of its monthly transacting users and demanded a $20 million ransom that Coinbase refused to pay. Last week, Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a "small subset" of customers, though funds were not affected.
Asset Holdings and AI Threat
Coinbase said customer assets are held 1:1 and are not lent out unless customers direct it. As of Sept. 30, it reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform. The company flagged artificial intelligence as a fast-changing threat and pledged further security investment.
Industry Fallout
The Binance theft, which the FBI has attributed to North Korea's TraderTraitor group, has rattled the industry. Blockchain analytics firm Elliptic found that the laundering spanned about 12,000 wallets in under four days, while stablecoin issuers froze about 44% of the haul. Separately, Brazil's Mercado Bitcoin halted withdrawals after a $40 million hack, and French bank Crédit Mutuel Arkéa recently confirmed a cyberattack that led to a $133 million crypto theft.
