In the aftermath of a significant security breach at crypto exchange Binance, Coinbase (NASDAQ: COIN) has publicly detailed its custody practices to reassure users that its platform remains insulated from similar risks.
The U.S.-based exchange stated on November 4, 2026, that more than 99% of customer cryptocurrency holdings sit in cold storage—offline wallets disconnected from the internet—and that its systems and customer funds were entirely unaffected by the Binance event.
The Binance incident, which occurred around October 29, 2026, ranks as one of the largest cryptocurrency thefts on record.
Attackers extracted roughly $6.3 billion to $6.4 billion from the exchange’s hot wallets across multiple blockchains, primarily within a short window of about 20 minutes.
According to Binance and subsequent reports, the breach involved sophisticated social engineering, including a fake job interview that provided access to internal systems, combined with the misuse of an internal AI tool.
Critically, the attackers did not obtain private keys; instead, they compromised authorization processes that allowed unauthorized withdrawals.
U.S. authorities, including the FBI, have attributed the attack to North Korea’s TraderTraitor group.
Binance has committed to covering the losses with company reserves and has reported replenishing approximately 98% of the affected assets through market purchases and internal funds, while expanding its proof-of-reserves reporting.
Against this backdrop, Coinbase emphasized the structural differences in its security architecture.
The exchange maintains only a limited portion of assets in internet-connected hot wallets solely to facilitate timely customer withdrawals.
Excess balances are continuously swept back into cold storage.
For its institutional Custody product, assets are held 100% offline and segregated on-chain.
Private keys associated with cold storage are fragmented through multiparty computation (MPC) techniques and never fully reconstructed in one place, even during transaction signing.
No individual employee possesses standing access to the hot-wallet signing service; any modifications require multiple independent approvals.Additional controls further constrain risk.
Rate limits restrict the speed at which funds can move from cold to hot wallets.
Anomaly detection systems flag unusual withdrawal patterns for manual review before processing.
In emergencies, the platform can activate kill switches that take signing keys offline entirely.
Coinbase designs its processes under the assumption that employees or devices may be targeted by phishing or other social engineering attacks, ensuring that a single compromised credential or session is insufficient to authorize sensitive actions.
The exchange also reiterated longstanding custody principles: customer assets are held on a strict 1:1 basis, remain the property of users, and are neither lent nor deployed for any purpose without explicit customer instruction.
As of September 30, 2026, Coinbase reported approximately $377 billion in assets on its platform, alongside substantial corporate cash holdings.
Its U.S. custody operations function as a fiduciary under New York law, while European operations are authorized under the Markets in Crypto-Assets (MiCA) framework and supervised by Luxembourg’s financial regulator.
The company further noted that advances in artificial intelligence are rapidly altering the threat landscape and pledged continued investment in security innovation.
These disclosures arrive amid broader industry scrutiny of hot-wallet exposure and authorization systems.
While Coinbase’s statements are self-reported, they align with its historical emphasis on offline storage and distributed key management.
The episode underscores ongoing challenges for centralized exchanges: balancing operational liquidity with robust isolation of the bulk of customer funds. Binance’s swift replenishment efforts and Coinbase’s detailed response illustrate differing approaches to restoring and maintaining confidence after high-profile incidents.
