Coinbase details security setup after $6.4B Binance breach
Regulation & Gov ·
The exchange says it was not touched by the attack and keeps more than 99% of customer holdings in offline storage.
Coinbase has moved to calm user concerns in the wake of a $6.4 billion theft from Binance's hot wallets, stating plainly that it was not caught up in the breach and that the bulk of its customer funds sit beyond the reach of online attackers. According to Decrypt, the company said over 99% of customer assets remain in cold storage, with only limited amounts shifted into internet-connected hot wallets to cover active withdrawal needs.
In a blog post, Coinbase outlined a layered defense system meant to prevent a comparable incident. Keys tied to cold storage are fragmented and never reconstructed in full, including during transaction signing, and the service that approves hot-wallet transfers is designed so no single staffer has standing access to it. Transfers from cold to hot wallets are throttled by rate limits, abnormal withdrawal activity gets flagged for manual review, and the firm retains the ability to shut down signing keys entirely through built-in kill switches, per Decrypt.
The company also addressed insider risk, noting that its systems are built around the expectation that employees could be targeted through phishing, so a compromised password, device, or session alone cannot be used to move funds — sensitive actions instead require multiple sign-offs. That emphasis follows a May 2025 episode in which Coinbase said bribed overseas support contractors leaked personal data belonging to under 1% of its monthly active users, part of an extortion attempt demanding $20 million that the company declined to pay. A separate incident last week involving analytics vendor Amplitude exposed contact information for a small group of customers, though no funds were affected.
Coinbase reiterated that customer assets are backed 1:1 and are not lent out unless users opt in, and disclosed $8.6 billion in cash and equivalents alongside $377 billion in platform assets as of September 30. It also named artificial intelligence as an emerging and fast-moving security risk. A corresponding report on WuBlockchain confirmed the exchange's unaffected status and its reliance on the same multi-layered cold storage architecture.
The Binance theft itself has been linked by the FBI to North Korea's TraderTraitor group, with blockchain analytics firm Elliptic tracing laundering activity across roughly 12,000 wallets within under four days; stablecoin issuers have since frozen about 44% of the stolen funds. Separate breaches at Brazil's Mercado Bitcoin and France's Crédit Mutuel Arkéa have added to industry unease. What remains unclear is whether Coinbase's disclosures will prompt comparable transparency from other exchanges, or further scrutiny of hot-wallet practices industry-wide.