Coinbase Says Customer Funds Are Held in Cold Storage After Binance Hack

Coinbase says it remains unaffected by the $6.34 billion Binance hot wallet hack, emphasizing that more than 99% of its customer assets are held in cold storage rather than connected to the internet.

The US exchange said it maintains limited hot wallet balances to process customer deposits and withdrawals while keeping the bulk of funds offline.

In a blog outlining its security measures, Coinbase detailed safeguards including distributed signing keys, withdrawal limits, unusual activity detection, and controls that can halt transaction signing.

The reassurance follows the October 29 Binance incident, in which attackers reportedly accessed an internal wallet signing service and moved assets outside the exchange’s normal withdrawal process.

Coinbase Explains How it Stores and Protects Customer Assets

Coinbase says customers retain ownership of digital assets held through its exchange, with internal records tracking account balances and transactions.

The company assured that it maintains customer assets on a 1:1 basis and says it does not lend or use them without explicit customer instructions.

Its custody system combines offline storage with secure multiparty computation (MPC), which distributes cryptographic signing authority among separate participants. This means there is no need for keeping a complete private key in one location for transaction approval.

Coinbase has also noted in its security page that it uses additional safeguards, including two-factor authentication, security key support, and Coinbase Vault, which can require multiple approvals before withdrawals are processed.

Notably, the company says it keeps customer assets separate from its corporate funds. Its latest quarterly filing reported approximately $377 billion in platform assets, alongside $8.6 billion in company cash and $2.2 billion in corporate crypto holdings.

These protections apply to hosted Coinbase.com accounts. Therefore, customers using their self-custody wallet remain responsible for securing their own private keys.

Coinbase also points to regulatory oversight and independent SOC 1 and SOC 2 Type II examinations as part of its security framework. However, these measures do not eliminate the possibility of a breach.

Could Coinbase Have Prevented the Binance Hack?

Coinbase is emphasizing its cold storage and distributed signing architecture as safeguards against the type of access and authorization failures involved in the Binance incident.

Although both exchanges use multiparty computation (MPC), Coinbase says keeping more than 99% of customer assets offline provides another layer of protection. However, these differences do not guarantee that Coinbase could never experience a similar breach.

According to Binance, the attack began with a fake job interview that gave hackers access to employees’ laptops. The attackers then submitted fraudulent withdrawal requests on October 29.

Notably, the Binance, Bybit, and Bitget thefts followed a similar pattern, with attackers manipulating transaction approval systems rather than directly stealing private keys.

The exchange also develops its security software internally, unlike the external vendor systems reportedly involved in the Bybit and Bitget incidents.

However, Coinbase has faced security problems of its own. In 2025, criminals bribed overseas customer support agents to obtain customer information. The exchange estimated that the incident could cost up to $400 million.

Coinbase has also warned that artificial intelligence is changing the threat landscape, giving attackers new ways to target employees, systems, and customers.

The distinction is that cold storage and distributed signing can reduce the risk of unauthorized access to customer funds, but they cannot eliminate every security threat.