Coinbase says over 99% of customer crypto is in cold storage after Binance hack

Coinbase said it was not affected by the hack of Binance, in which attackers drained about $6.4 billion from the rival exchange's hot wallets. In a blog post published on Wednesday, Coinbase said that more than 99% of customer assets are held in cold wallets, meaning offline storage that cannot be reached over the internet. According to the company, funds are moved into hot wallets only as customers need them.

Security controls Coinbase described

As reported by Decrypt, Coinbase listed several layers of protection. Private keys for its cold wallets are split into pieces and are never fully reassembled, even when signing transactions. No single employee has standing access to the hot-wallet signing service. Limits cap how fast funds can move from cold to hot wallets, and unusual withdrawal spikes are held for staff review. The exchange can also trigger a 'kill switch' that takes signing keys offline entirely.

The company said it assumes employees will be targeted by phishing, so a stolen password, session or device cannot be used on its own, and sensitive actions require multiple approvals. Coinbase also said customer assets are held 1:1 and are not lent out unless customers direct it to do so. It described artificial intelligence as a fast-changing security threat and pledged further investment in security.

Context: Coinbase's previous incidents

The focus on insiders carries particular weight for Coinbase. In May 2025, the company disclosed that criminals had bribed overseas customer support agents to steal personal data on less than 1% of its monthly transacting users, then demanded a $20 million ransom, which Coinbase refused to pay. Last week, Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a 'small subset' of customers, though funds were not affected.

What is known about the Binance hack

Decrypt reported that the FBI has attributed the Binance theft to North Korea's TraderTraitor group. Blockchain analytics firm Elliptic found that the laundering spanned about 12,000 wallets in under four days, and stablecoin issuers froze about 44% of the stolen funds. Separately, Brazil's Mercado Bitcoin halted withdrawals after a $40 million hack, and French bank Crédit Mutuel Arkéa suffered a cyberattack that resulted in a $133 million crypto theft.