Coinbase says it holds more than 99% of customer cryptocurrency in offline cold wallets, outlining its custody safeguards after Binance's $6.34 billion hack on October 29 raised questions about how exchanges approve fund transfers. The company said the breach did not affect its systems or customer funds.

Cold wallets are storage devices kept disconnected from the internet, which limits online access to the funds they hold. Exchanges typically maintain smaller online balances — often called hot wallets — to process customer withdrawals.

Coinbase Outlines Its Custody Controls

According to Coinbase, the vast majority of customer holdings sit offline, with only enough kept online to handle withdrawals. The exchange says in a blog post that transfers are protected by controls including spending limits, unusual-activity checks and the ability to stop transaction approvals.

The company also splits signing keys across different systems, an arrangement under which no single person or machine holds a complete key — so compromising any single machine would not, by itself, yield one. Coinbase says customer assets are backed one-to-one and are not lent without permission, and that its custody business is overseen by New York regulators.

Binance Hack Exposes Withdrawal Approval Risks

Binance said attackers gained access to its wallet-signing service, the system that authorizes outgoing transfers, after compromising employee computers through malicious downloads and a fake job interview. The exchange's account of the October attack describes how the stolen credentials helped hackers move funds outside normal withdrawal procedures.

Binance said about $2.85 billion had been frozen or intercepted as of November 3. It reported replenishing 98% of affected token assets and pledged to cover customer losses. Based on its reported figures, the remaining 2% of affected token assets had yet to be replenished.

The incident involved transaction permissions rather than a reported theft of private keys — a distinction that shows offline storage alone cannot prevent the abuse of an authorized signing process.

Other Exchanges Face Similar Security Questions

Brazil's Mercado Bitcoin reported a November 2 attack involving approximately $38 million, announcing a plan to cover customer losses after suspicious transfers were detected across several blockchains. The attack came days after the Binance hack, and Mercado Bitcoin's pledge to cover customer losses paralleled Binance's own commitment.

Coinbase reported $376.6 billion in assets on its platform as of September 30, 2026. Its filing listed $8.6 billion in company cash and $2.2 billion in investment crypto, separate from customer holdings. Research estimates that Coinbase safeguards roughly 84% of US spot Bitcoin ETF assets. The company has also said a 2025 support-agent data breach could cost up to $400 million.

South Korea Reviews Offline Wallet Rules

South Korea's financial regulator urged cryptocurrency exchanges to increase their cold storage holdings after the Binance breach. Existing rules already require at least 80% of customer crypto to be held in cold storage, and Upbit reported 99.17% at the end of September.

As Binance reopened services, it warned users about withdrawal scams, including offers to speed up transfers for a fee. Holding more funds offline can slow access: Bithumb customers faced withdrawal delays exceeding 13 hours in August when online wallet balances ran low. Weighing larger offline reserves against withdrawal speed is the trade-off South Korean exchanges now face as regulators review the rules.