Coinbase says more than 99% of its customers’ crypto sits in cold storage, offline wallets that hackers cannot reach over the internet. It is the exchange’s answer to a $6.3 billion theft at rival Binance.
But Binance says its thieves never touched its private keys. They fooled the systems that approve withdrawals. Based on research, Coinbase holds 84% of US spot Bitcoin ETF assets.
How Coinbase Secures User Funds
Coinbase had $377 billion in assets on its platform at the end of September. It says that money belongs to customers, not the company.
“Coinbase does not lend or use those assets unless customers instruct us to.”
It also points to its S&P 500 listing and regular audits. Its US custody arm answers to New York’s banking regulator.
So how does it protect the funds?
- Separate books are the first safeguard.
Coinbase tracks the $377 billion apart from its own $8.6 billion in cash and $2.2 billion in crypto, per its latest quarterly filing.
- Legal duty is the second.
Its New York custody arm is a qualified custodian and a fiduciary, bound by law to put clients’ interests first. In Europe, Luxembourg’s financial watchdog supervises Coinbase under the EU’s Markets in Crypto-Assets (MiCA) rules.
- Outside testing is the third.
Coinbase says it was among the first crypto custodians to pass SOC 1 and SOC 2 Type II exams. Those audits check whether its security controls actually work.
- The last line of defense are the people.
Security chief Jeff Lunglhofer previously ran information security at BNY. His team of cryptographers and investigators comes from finance, national security, and law enforcement.
How Binance Lost $6.3 Billion Without Losing Its Keys
The attack began with a fake job interview, Binance said. Hackers then reached staff laptops and sent fake withdrawal requests on October 29.
BeInCrypto reported on November 1 that the Binance, Bybit, and Bitget thefts followed one pattern. Attackers tricked each exchange’s approval system into signing withdrawals. None stole a private key.
The report also weighed Coinbase’s security record against that pattern. Coinbase splits each private key into pieces stored on separate machines, a method called multi-party computation (MPC).
It also builds its security software in-house, while the Bybit and Bitget breaches came through outside vendors. Researchers argue that a stolen Coinbase laptop would yield only one useless key piece.
Nevertheless, Coinbase has been hit before. In 2025, criminals bribed overseas support agents for customer data. The exchange estimated the cost at up to $400 million.
Its new post warns that artificial intelligence (AI) is changing how attackers work.
Is Locking Crypto Offline Worth Slower Withdrawals?
Elsewhere, local media reported that South Korea’s Financial Services Commission urged exchanges on Monday to keep more than the legal 80% minimum offline. The Herald Business reported that Upbit already held 99.17%.
Notably, however, offline coins move slowly. Some Bithumb withdrawals were stuck for more than 13 hours in August when its online wallet ran dry, the Seoul Shinmun reported.
Korean exchanges warn that extra security staff will raise costs. Smaller platforms may not afford it, Newsway reported, leaving users with the biggest players.
