Coinbase said it was not affected by last week's hack of Binance, in which attackers drained roughly $6.4 billion from the rival exchange's hot wallets, and moved to reassure customers that what happened at Binance could not easily happen on its platform. In a blog post published Wednesday, the U.S. exchange detailed controls including split private keys, withdrawal rate limits, anomaly detection and "kill switches" that can take signing keys offline, and said it keeps more than 99% of customer assets in offline cold storage.

Cold storage refers to offline wallets that cannot be reached over the internet. Coinbase said it moves funds into internet-connected hot wallets only as customers need them. The distinction maps directly onto the Binance theft, where the stolen funds came from the internet-connected side of an exchange's custody setup — precisely the exposure cold storage is built to keep out of reach.

The Binance incident, the post said, "has understandably left customers asking" how Coinbase guards against a similar attack.

Layered Custody Controls

Coinbase laid out several layers of protection for its custody infrastructure. Private keys for its cold wallets are split into pieces and never fully reassembled, even when signing transactions, and no single employee has standing access to the hot-wallet signing service. Strict limits cap how quickly funds can move from cold to hot wallets, and unusual withdrawal spikes are held until staff review them. The exchange can also trigger "kill switches" that take signing keys offline entirely.

The company said it assumes employees will be targeted by phishing, so its controls are designed so that a stolen password, session or device cannot be used on its own, and sensitive actions require multiple approvals.

Insider Risk Under Scrutiny

That focus on insiders carries weight for Coinbase. In May 2025, the company disclosed that criminals had bribed overseas customer support agents to steal personal data on less than 1% of its monthly transacting users, then demanded a $20 million ransom that Coinbase refused to pay.

Last week, Coinbase said a separate security incident at analytics vendor Amplitude had exposed contact data for a "small subset" of customers, though funds were not affected. Neither episode involved a breach of cold storage itself; both ran through people and third-party vendors, the channels around an exchange's wallet infrastructure that can expose customer data even when the wallets themselves are untouched.

1:1 Custody and Balance Sheet

Coinbase reiterated that customer assets are held 1:1 and are not lent out unless customers direct the exchange to do so. The company reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30. It flagged artificial intelligence as a fast-changing security threat and pledged further security investment.

Fallout From the Binance Hack

The Binance theft, which the FBI has attributed to North Korea's TraderTraitor group, has rattled the industry. Blockchain analytics firm Elliptic found that the laundering spanned about 12,000 wallets in under four days, while stablecoin issuers froze about 44% of the haul — leaving most of the stolen funds outside frozen addresses.

Separately, Brazil's Mercado Bitcoin halted withdrawals after a $40 million hack, and French bank Crédit Mutuel Arkéa recently confirmed a cyberattack that led to a $133 million crypto theft. The cluster of recent incidents — spanning an exchange, a Brazilian platform and a French bank — has kept custody and withdrawal safeguards in the industry spotlight, the backdrop against which Coinbase published its walk-through of its own defenses.