Coinbase says it was not affected by Binance’s hot wallet incident, and over 99% of user assets are stored in cold wallets
Coinbase published an article on November 4, 2026, introducing its user asset protection mechanisms, and said it was not affected by Binance’s earlier hot wallet security incident, and that neither the platform’s systems nor user funds have been affected at present.
Coinbase said that currently more than 99% of user assets are stored in cold wallets, and that hot wallets retain only a small amount of funds to meet users’ daily withdrawal and usage needs, with balances adjusted dynamically according to deposit and withdrawal demand. Its institutional custody vault assets all use cold storage and are independently isolated on-chain.
In terms of fund transfer security, Coinbase uses distributed key protection, withdrawal limits, abnormal activity monitoring and an emergency stop mechanism. The private keys of cold wallets are stored in a split form, and the keys are never fully reconstructed during the signing process; the key-signing service in the hot wallet production environment also does not allow independent access by a single person. If abnormal transactions or a surge in withdrawal volume are detected, the system will trigger an investigation and limits, and if necessary, some or all fund transfers can be suspended by shutting down the signing keys.
Coinbase also said that user assets are always held by users, the platform holds assets on a 1:1 basis, and it will not lend out or misappropriate them without user instructions. As of September 30, 2026, Coinbase platform assets reached $377 billion, with $8.6 billion in cash and cash equivalents and $2.2 billion in investment-grade crypto assets. The company said that as the development of AI capabilities changes the security risk landscape, it will continue to increase investment in security technology.
Original source:
Title: Coinbase says 99% of customer assets sit in cold storage after Binance’s $6.3 billion breach Publisher: The Block Publication date: 2026-11-04 URL: https://www.theblock.co/news/ecosystems/2026-11-04-coinbase-security-cold-storage-binance-hack-432880 Nature of source: media report Verification status: the relevant passages were actually read in this review, verification date 2026-11-04; the article quotes Coinbase’s blog post and company statements published that day Supporting content: supports the body’s claims about being unaffected by the incident, over 99% in cold storage, dynamic adjustment of hot wallets, distributed keys and emergency stop mechanisms, 1:1 holding, platform asset scale, and the cash/investment-grade crypto asset figures; does not prove the full original Coinbase blog post text or an independent audit result
ABAB AI Insight
Coinbase was founded by Brian Armstrong in 2012 and has long emphasized regulated custody and cold storage strategies, publicly stating early on that most customer assets were moved to offline storage. Its custody business is operated by a qualified custodian regulated by New York State and has passed SOC 1/SOC 2 audits. This post was a response to Binance’s hot-wallet-related security incident of about $6.3 billion on October 29, in which the attacker allegedly completed the transfer through internal processes rather than by directly obtaining private keys.
Coinbase’s platform assets reached $377 billion as of September 30, corresponding to its Q3 financial report metric of Assets on Platform, about 12.5% of the total crypto market capitalization at the time. The company itself held $8.6 billion in cash and cash equivalents and about $2.2 billion in investment-grade crypto assets, separated on the balance sheet from customer assets. Hot wallets retain only the liquidity needed for daily operations, with the rest moved into cold storage, and key material is split using multi-party computation (MPC) to avoid any single point of full reconstruction.
Compared with exchanges such as Binance that emphasized replenishing reserves and expanding proof of reserves after the incident, Coinbase highlights its alignment with regulated custody standards by emphasizing its cold storage ratio, key splitting, and controls that can pause signing. Institutional vault assets are entirely in cold storage and isolated on-chain, further distinguishing retail hot wallets from institutional custody.
This mechanism reduces the online attack surface, but it also means that daily withdrawals rely on dynamic replenishment of hot wallet balances. Against the backdrop of AI tools being used for social engineering and internal process attacks, Coinbase said it will increase security investment, and the points to watch are whether it later discloses specific changes in cold/hot wallet ratios, strengthened access controls for signing services, or progress in sharing threat intelligence with other exchanges.
ABAB News · Cognitive Law
Keeping the vast majority of customer assets in offline cold storage can shift the online attack surface from the assets themselves to process and approval steps.
Distributed keys and a signing service that can be shut down allow fund transfers to be interrupted even if a single point or internal credential is exploited.