Coinbase Says 99% of Customer Crypto Is Offline and Out of Hackers’ Reach

By Decrypt Staff

Coinbase is moving to reassure customers that what happened at Binance can’t easily happen there.

In a blog post Wednesday, the U.S. exchange said it wasn’t affected by last week’s hack of Binance, in which attackers drained about $6.4 billion from the rival exchange’s hot wallets.

Coinbase said it keeps more than 99% of customer assets in cold storage, meaning offline wallets that can’t be reached over the internet. It moves funds into internet-connected hot wallets only as customers need them.

The Binance incident “has understandably left customers asking” how Coinbase guards against a similar attack, the post said.

Coinbase laid out several layers of protection. Private keys for its cold wallets are split into pieces and never fully reassembled, even when signing transactions, and no single employee has standing access to the hot-wallet signing service. Strict limits cap how fast funds can move from cold to hot wallets, and unusual withdrawal spikes are held until staff review them. The exchange can also trigger “kill switches” that take signing keys offline entirely.

The company said it assumes employees will be targeted by phishing, so its controls are designed so that a stolen password, session or device can’t be used on its own, and sensitive actions require multiple approvals.

That focus on insiders carries weight for Coinbase. In May 2025, it disclosed that criminals had bribed overseas customer support agents to steal personal data on less than 1% of its monthly transacting users, then demanded a $20 million ransom that Coinbase refused to pay.

Last week, Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a “small subset” of customers, though funds weren’t affected.

Coinbase also said customer assets are held 1:1 and aren’t lent out unless customers direct it to, and it reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30. It flagged artificial intelligence as a fast-changing threat and pledged further security investment.

The Binance theft, which the FBI has attributed to North Korea’s TraderTraitor group, has rattled the industry. Blockchain analytics firm Elliptic found that the laundering spanned about 12,000 wallets in under four days, while stablecoin issuers froze about 44% of the haul.

Separately, Brazil’s Mercado Bitcoin halted withdrawals after a $40 million hack, and French bank Crédit Mutuel Arkéa recently confirmed a cyberattack that led to a $133 million crypto theft.

Recommended News