Coinbase says over 99% of customer crypto sits in offline cold storage

First reported 04 Nov, 20:46 UTCSource: Decrypt + 1 moreLast editorial activity 04 Nov, 20:46 UTCWrite a comment ↓

Close-up of Bitcoin coins on an investment guide paper. — Illustrative photo.Photo by Alesia Kozik on PexelsCoinbase logo shown for identification only; no affiliation with or endorsement of WORLDTECH is implied.

Coinbase has told customers it was not affected by the hack of Binance, in which about $6.4 billion was drained from the rival exchange's hot wallets, and has laid out the controls it says protect their holdings. The company says more than 99% of customer assets are kept in offline cold storage, beyond the reach of attackers on the internet.

Coinbase distances itself from Binance breach

Coinbase said it was not affected by last week's attack on Binance, the exchange and finance company based in the United Arab Emirates, from whose hot wallets attackers took about $6.4 billion. The message is intended to reassure customers that a comparable incident cannot easily happen on Coinbase's platform.

The argument rests on the separation of two storage types. Cold wallets, which hold the bulk of customer assets, keep crypto keys on devices that never connect to the internet, while hot wallets stay online to serve day-to-day activity.

Layered controls over keys and withdrawals

Coinbase described several protective layers. The private keys for its cold wallets are divided into pieces that are never fully reassembled, even when a transaction is signed. No individual employee holds standing access to the hot-wallet signing service. Funds move from cold to hot wallets only when customers need them, and strict caps limit how quickly that transfer can happen.

Unusual spikes in withdrawals are held back until staff have reviewed them. The exchange can also activate kill switches that take signing keys offline completely. According to Coinbase, customer assets are held one-to-one.

Phishing and employee risk

The company assumes staff will be targeted by phishing, so its safeguards are built so that a stolen password, session or device cannot succeed on its own, and sensitive actions require several approvals.

Coinbase also named artificial intelligence as a fast-changing security threat. The reporting does not describe how the company is responding to that risk.

Earlier data incident in background

The reporting recalls that in May 2025 Coinbase disclosed that criminals had bribed overseas customer support agents to access personal data on less than 1% of its monthly transacting users. The attackers then demanded a $20 million ransom, which Coinbase refused to pay.

Open questions

Can the claim that more than 99% of customer assets are offline be independently verified?

Key facts

Coinbase says it keeps more than 99% of customer assets in cold storage, meaning offline wallets that cannot be reached over the internet.

Coinbase says it was not affected by the $6.4 billion Binance hack.

Coinbase says it moves funds into internet-connected hot wallets only when customers need them.

Coinbase says customer assets are held one-to-one.

Coinbase says it can trigger kill switches that take signing keys offline entirely.