1. Coinbase Security Controls After the Binance Theft
Coinbase said on November 4 that the roughly $6.4 billion hot-wallet theft at rival exchange Binance had no effect on its own platform, and it used the occasion to lay out how it protects customer assets. In a blog post, the company said more than 99% of customer crypto sits in offline cold storage, with keys split and kill switches in place.
The statement arrives while the industry is still absorbing the scale of the Binance loss. Exchanges of every size are being asked by customers a simple question: could the same thing happen here? Coinbase chose to answer it publicly, describing both the architecture of its wallets and the human processes that surround them.
2. How Much of Coinbase's Customer Crypto Is Offline?
More than 99% of customer assets are held in cold storage, meaning wallets whose keys are kept away from the internet. Coinbase moves funds into internet-connected hot wallets only when it needs them, for example to process withdrawals. The remainder, under 1%, is the operating float that makes day-to-day transfers possible.
The ratio matters because a hot wallet is the part of an exchange that an attacker can actually reach. A thief who compromises a hot-wallet system can drain only what that system holds. By keeping the overwhelming majority of assets offline, Coinbase argues that the worst realistic outcome of an intrusion is bounded to a small slice of the total, not to the whole customer pool.
Coinbase also stressed that customer holdings are kept one-to-one, and that it does not lend them out unless a customer directs it to. That distinction separates assets held on behalf of clients from the exchange's own balance sheet, and it shapes what a breach would mean for account holders.
3. Why Split Private Keys Are Hard to Steal
Coinbase said the private keys for its cold wallets are split into parts and are never reassembled in one place, even when a transaction is being signed. In practice this means no single device, location or person ever holds the complete key. An attacker would have to compromise several separate pieces at once, and each piece sits under its own controls.
Key splitting is a widely used technique in custody. A private key is the secret that authorizes the movement of funds, so whoever holds it can spend the assets. Dividing it removes the single point of failure that makes a conventional key such an attractive target, and it lets a custodian require cooperation between independent parts of its organization before anything moves.
The company added that no individual employee has standing access to the signing service for its hot wallets. Access is not a permanent entitlement that can be stolen along with a login; it is granted only as part of controlled procedures.
4. What Limits Apply to Moving Funds From Cold to Hot Wallets?
Coinbase said it caps how quickly funds can travel from cold storage to hot wallets. Even someone with legitimate authority therefore cannot shift a large share of customer assets into reachable wallets in a single step. The limit works like a speed governor on the most sensitive route in the system.
Withdrawal activity is also monitored. When outflows spike beyond what the company considers normal, those transfers are held so that staff can review them before they proceed. The pause converts a fast, automated drain into a slower process in which a human has the chance to notice that something is wrong.
This layer targets a pattern common to large exchange thefts: once an attacker gains the ability to sign, speed is their advantage. Throttling and review are designed to take that advantage away, buying time for the company to respond.
5. Can Coinbase Switch Off Its Own Signing Keys?
Yes. Coinbase described kill switches that allow it to take its signing keys offline entirely. If monitoring indicates an attack in progress, the company can cut the ability to authorize transactions altogether, instead of trying to block suspicious transfers one by one.
A kill switch trades availability for safety. Customers may be unable to withdraw while the keys are offline, but funds stay in place. For a custodian, that is generally the preferable failure mode, because a delayed withdrawal can be fixed afterward while an emptied wallet cannot be undone.
6. Why Coinbase Assumes Employees Will Be Phished
The company said its security model starts from the premise that employees will, at some point, be phished. A stolen password, session or device is therefore not enough on its own to cause harm. Sensitive actions require multiple approvals, so one compromised account cannot complete them alone.
This reflects a shift in how security teams think about risk. Instead of trying to guarantee that no staff member is ever deceived, the design assumes deception will sometimes succeed and limits what a deceived person can do. Layered approvals mean an attacker must fool several people or systems in coordination, which is considerably harder than fooling one.
Coinbase has its own history on this front. In May 2025 it disclosed that criminals had bribed overseas support agents to obtain data on fewer than 1% of its monthly transacting users, and it declined to pay a $20 million ransom demand. More recently it said a breach at the analytics vendor Amplitude exposed contact details for what it called a small subset of customers, with no effect on funds. Those episodes involved people and vendors, not the wallets themselves, which helps explain why the company puts such weight on approvals and access limits.
7. What Do Coinbase's Reserves and Balance Sheet Look Like?
As of September 30, Coinbase reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform. The company cited the figures to show the scale of what it safeguards and the resources behind its security spending.
The cash figure is separate from customer holdings. Corporate cash and equivalents belong to the company, while the platform assets are those held for customers. Presenting both in the same post signals that Coinbase wants to be judged on the strength of its own finances as well as its custody design.
8. What Happened in the Binance Theft?
The attack Coinbase referred to targeted Binance's hot wallets and totaled about $6.4 billion. The FBI attributes it to North Korea's TraderTraitor group, a state-linked hacking unit. Blockchain analytics firm Elliptic traced laundering across about 12,000 wallets in under four days, and stablecoin issuers froze roughly 44% of the stolen funds.
The Binance incident is not the only recent loss. Brazil's Mercado Bitcoin halted withdrawals after a hack of about $40 million, and the French bank Crédit Mutuel Arkéa confirmed a cyberattack tied to a crypto theft of $133 million. Together the cases show attackers going after exchanges, banks and service providers alike.
Every exchange faces the same tension. Customers expect to withdraw at any hour, and that requires some funds to be held in wallets connected to the internet, where software can sign transactions quickly. Cold storage keeps keys isolated from networks, which makes theft far harder, but also makes movement slower and more procedural.
Security design at a custodian is largely the work of deciding how much sits on each side and how tightly the bridge between them is controlled. A larger hot balance makes service smoother and raises the stakes of a breach; a smaller one does the opposite. Coinbase's figure of more than 99% offline places it firmly toward the cautious end of that trade-off, and its transfer caps and review rules govern the route funds take between the two.
Because hot wallets are the exposed surface, most large exchange thefts in the industry's history have involved them or the systems that control them. That is why the details Coinbase chose to publish concentrate on the signing service, the keys behind it and the people allowed to touch it.
Security has become a point of competition among trading platforms, and a public explanation like this one doubles as a message to users deciding where to keep their funds. By stating that it was unaffected and describing its controls, Coinbase is positioning custody discipline as a reason to trust it.
Users weighing platforms after a major theft typically look for several things: how much is held offline, whether assets are lent out, how withdrawals are screened and what the company can do if an attack begins. Coinbase's post addresses each of these in turn, and it pairs them with the balance sheet figures reported at the end of September.
Competitors are likely to be asked the same questions by their own customers, and the level of detail Coinbase has now put on the table sets a benchmark for those answers.
9. How Is AI Changing the Threat?
Coinbase flagged artificial intelligence as a fast-moving security risk and said it would keep investing in defenses against it. The company did not describe specific AI-enabled attacks in its post, and it did not tie the risk to any particular incident.
The concern is general but real for any firm that depends on staff vigilance: tools that generate convincing messages and impersonations can make phishing cheaper and more persuasive. That is one more reason Coinbase's approach rests on controls that still hold when a person is fooled.
10. What Should Customers Take From the Statement?
The post is a description of design intent, not an independent audit. Customers cannot verify from the outside how closely day-to-day practice matches the controls described, and no exchange's architecture can rule out every failure. What the statement does provide is a concrete list of safeguards against which Coinbase can be measured in the future: offline storage above 99%, split keys, transfer caps, withdrawal review, kill switches and multi-party approvals.
For an industry that has just watched one of its largest platforms lose billions of dollars, the emphasis on limiting damage, rather than only preventing intrusion, is the central message. Whether other exchanges publish comparable detail in the coming weeks will show how far the Binance theft has changed expectations about transparency.