Coinbase says 99% of customer assets are in offline storage after Binance hack

Coinbase says it was not affected by the Binance hack

Coinbase said in a blog post on Wednesday that it was not affected by last week’s hack of Binance.

The post said attackers drained about $6.4 billion from Binance’s hot wallets. A hot wallet is a wallet connected to the internet. Coinbase said the Binance incident has left customers asking how Coinbase protects against a similar attack.

Main points in the Coinbase post

• Coinbase said it keeps more than 99% of customer assets in cold storage, meaning offline wallets that cannot be reached over the internet.
• It moves funds to internet-connected hot wallets only as customers need them.
• Customer assets are held 1:1. That means one customer asset is held for each customer asset owed.
• Coinbase said assets are not lent out unless customers direct it to do so.
• Coinbase flagged artificial intelligence as a fast-changing security threat and pledged further security investment.

What Coinbase says about its controls

Coinbase described several layers of protection. Private keys for its cold wallets are split into pieces and never fully reassembled, even when signing transactions. A private key is a secret code used to approve a transaction.

No single employee has standing access to the hot-wallet signing service. Strict limits cap how fast funds can move from cold to hot wallets. Unusual withdrawal spikes are held until staff review them.

The exchange can also trigger kill switches that take signing keys offline entirely. It said it assumes employees will be targeted by phishing, so a stolen password, session or device cannot be used on its own. Sensitive actions require multiple approvals.

Coinbase also reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30.

Past incidents mentioned in the post

Coinbase said that in May 2025, criminals bribed overseas customer support agents to steal personal data on less than 1% of its monthly transacting users. It said the criminals demanded a $20 million ransom, which Coinbase refused to pay.

Last week, Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a small subset of customers. It said funds were not affected.

What other sources report about the Binance theft

The source article says the FBI has attributed the Binance theft to North Korea’s TraderTraitor group. That attribution is reported by the source article, not stated by Coinbase in its post.

Blockchain analytics firm Elliptic found that laundering spanned about 12,000 wallets in under four days. Stablecoin issuers froze about 44% of the haul, according to Elliptic as reported in the source article. A stablecoin is a token designed to hold a steady value, often linked to the U.S. dollar.

Separately, the source article reports that Brazil’s Mercado Bitcoin halted withdrawals after a $40 million hack. It also reports that French bank Crédit Mutuel Arkéa recently confirmed a cyberattack that led to a $133 million crypto theft.

Why this matters

Coinbase is using the post to reassure customers about its own security after the Binance hack. It points to offline storage and multiple approval controls as the main protections.

The post also draws attention to risks from phishing and from staff being targeted, and to artificial intelligence as a fast-changing threat.

Sources

• Decrypt