Coinbase said more than 99% of customer assets are held in offline cold storage, detailing its custody defenses after Binance disclosed a $6.34 billion theft on Oct. 29, 2026. In a Nov. 4 disclosure, the publicly traded U.S. exchange described distributed signing keys, emergency shutdown controls and withdrawal restrictions. Coinbase said its systems and customer funds were unaffected by the Binance incident.
Cold Storage and Liquidity
In a statement on X, Coinbase emphasized the importance of maintaining customer confidence after the multibillion-dollar breach at Binance. "Users come to Coinbase to keep their money secure. We make sure that stays true," the exchange wrote, adding that "secure custody is daily work for us, not a one-time achievement."
In an accompanying blog post titled "How Coinbase Protects Customer Assets," the company said its internet-connected hot wallets hold enough liquidity for withdrawals and transfers, while excess balances are routinely moved into offline custody. Its institutional custody vault product operates entirely through cold storage, with holdings segregated onchain. Coinbase maintains that customer deposits are backed 1:1, remain customer property, and are never lent or deployed without authorization.
How the Exchange Protects Funds
Coinbase said its custody security relies on distributed cryptographic keys, transaction restrictions and emergency controls intended to prevent unauthorized asset movements.
- In cold-wallet operations, private keys are divided into separate components and never reconstructed in their entirety, even during transaction signing.
- Hot-wallet infrastructure requires multiple employees to authorize production changes, preventing any single individual from independently modifying critical signing services.
- Automated anomaly detection and transfer limits can interrupt suspicious withdrawals while security personnel investigate.
- Emergency kill switches can disable signing operations altogether, and compromised systems cannot resume processing transactions until investigators determine that operations are secure.
- Employee permissions are restricted through temporary access privileges, phishing-resistant authentication and additional approval requirements for sensitive activities.
Coinbase said these arrangements are intended to limit the damage caused by stolen credentials, compromised devices or malicious insiders. The company's claim that more than 99% of customer assets are stored offline is self-reported, and the precise allocation has not been independently established by third parties.
What the Binance Hack Exposed
The Oct. 29 Binance attack involved a social engineering campaign that compromised employee devices and eventually reached Binance's internal wallet-signing infrastructure, according to the exchange. Attackers drained approximately $6.34 billion in cryptocurrencies across multiple blockchain networks, making it the largest reported cryptocurrency exchange theft to date.
Binance temporarily suspended withdrawals while coordinating with stablecoin issuers and other industry participants to freeze or intercept stolen assets. The exchange subsequently pledged to cover affected customer balances through corporate reserves and its Secure Asset Fund for Users (SAFU).
For comparison, the February 2025 Bybit breach resulted in approximately $1.5 billion in stolen cryptocurrencies, then a record for the industry. The Binance incident has intensified scrutiny of online custody systems, particularly the operational procedures governing access to private keys and authorization of large transactions.
Coinbase's Financial and Regulatory Position
Coinbase points to its financial disclosures, regulatory supervision and independent control examinations as supporting evidence of its custody practices. As of Sept. 30, 2026, the company reported $8.6 billion in cash and cash equivalents, $2.2 billion in crypto assets held for investment, and $377 billion in total assets on its platform.
The exchange is publicly traded in the United States, files audited annual financial statements with the Securities and Exchange Commission, and operates under numerous regulatory licenses. Its U.S. custody subsidiary, Coinbase Custody Trust Company, is regulated by the New York Department of Financial Services.
Coinbase has also completed SOC 1 Type II and SOC 2 Type II examinations covering specified operational controls. Those examinations provide assurance about the controls within their assessed scope, but they do not independently establish that every customer asset is protected against theft. Coinbase further acknowledged that advances in artificial intelligence are changing cybersecurity threats, requiring continued investment in defensive technology.
Ultimately, the company's disclosed safeguards explain how it seeks to protect customer holdings, but its cold-storage percentage remains a company-reported figure rather than an independently verified guarantee against future attacks.
