Coinbase explains how it keeps 99% of client funds offline

Coinbase has explained to customers why the Binance breach did not touch it. In a blog post, the exchange said more than 99% of user assets sit in cold storage, meaning wallets with no connection to the internet. Hackers pulled about $6.4 billion out of Binance's hot wallets, so the question "could this happen to you?" became the one customers kept asking.

What exactly did Coinbase say?

The post went out on Wednesday, November 4. The exchange said it was not affected by the incident and listed several layers of protection. Only a small share of assets sits in hot wallets, the ones that can pay out quickly. The rest moves there only when customers actually need to withdraw.

The company also reminded readers about its balance sheet. Customer assets are held 1 to 1 and are not lent out unless the customer gives the order. As of September 30 the exchange held $8.6 billion in cash and equivalents, with $377 billion in assets on the platform.

Why did the question get so sharp?

The Binance breach was the largest in the industry's history by size, and the fallout is still running. According to CoinDesk, North Korean hackers have resumed laundering the loot, and Cointelegraph reported that 81% of the stolen Solana has already moved through THORChain. Getting such money back is hard.

The market reacted nervously. Coinbase shares dropped 13% right after news of the breach, even though the exchange itself was not involved. Binance founder Changpeng Zhao called for a security alliance across the industry, since attacks that use AI are speeding up. So a public breakdown of defenses from Coinbase also reads as an answer to what the market is asking.

How does the key protection work?

To see the difference, recall what hot and cold wallets are. A hot wallet is connected to the network, so it is fast but exposed. A cold wallet sits offline and cannot be reached over the internet. Coinbase described these mechanisms.

• Split keys: private keys for cold wallets are cut into pieces and never put back together, even when a transaction is signed.
• No single employee has standing access to the service that signs hot-wallet operations.
• Strict limits cap how fast funds can move from cold storage to hot wallets.
• Unusual spikes in withdrawals are held until a person reviews them.
• Kill switches can take signing keys fully offline.

The idea is that one stolen credential should not open the whole vault. An attacker has to get through several walls in a row, and even then the withdrawal speed hits a cap.

What does the exchange do about people?

Coinbase assumes its employees will be phished. So a stolen password, session or device is not enough on its own, and sensitive actions need several approvals.

For the exchange this is not abstract. In May 2025 it disclosed that criminals had bribed overseas support agents, then stole data on less than 1% of monthly transacting users and demanded a $20 million ransom. Coinbase refused to pay. Later, contact details of a "small subset" of customers leaked through the analytics vendor Amplitude, though funds were not affected.

Is that enough to trust it?

Looked at soberly, this is the exchange's own description, not an independent audit. An ordinary customer cannot check that 99% is really offline. Still, specific mechanisms (limits, split keys, kill switches) carry more weight than vague talk about the "highest level of security".

The exchange also called artificial intelligence a fast-changing threat and promised to invest more in security. Other players in the market have raised the same topic since the Binance breach.

What this means for users

The practical takeaway is simple. Even the most reliable exchange is still someone else's vault. Anyone holding large sums can split them, keeping operating funds on the exchange and the rest on a hardware wallet such as Ledger. Ukrainians who buy and sell Bitcoin through exchanges and P2P can start with two questions for the platform. Does it disclose how it stores keys? And does it confirm 1 to 1 backing?