Coinbase Says Over 99% of Customer Assets Are in Cold Storage
Coinbase says more than 99% of customer crypto assets are held offline and outlines signing safeguards following Binance’s $6.34 billion hack.
Key Notes
- Coinbase says more than 99% of customer crypto assets are held in offline cold storage.
- The exchange describes distributed keys and transfer controls and says it was unaffected by the Binance incident.
- Its crime-insurance policy covers only part of digital assets and has account-access exclusions.
Coinbase said it keeps more than 99% of customer crypto assets in offline cold storage, publishing a detailed account of its safeguards after Binance’s October 29 hot-wallet attack.
In a November 4 statement, the exchange also emphasized one-to-one asset backing, audited financial statements and distributed key protection. Coinbase said its systems and customer funds were unaffected by the Binance incident.
How Coinbase Says Its Wallet Controls Work
The company’s custody overview describes hot wallets holding a small allocation for withdrawals, with excess assets continually moved back offline. Balances are rebalanced as customer demand changes. Its dedicated Custody vault product is described separately as fully cold and segregated onchain.
For cold-storage transactions, Coinbase says private keys are split into pieces and are never reconstructed in full during signing. For hot-wallet systems, changes to the production signing service require multiple personnel. The company presents those controls as protection against an individual compromised employee, device or server authorizing transfers alone.
It also describes limits on transfers from cold to hot wallets, monitoring for unusual activity and stop mechanisms that can take signing keys offline. Customer assets remain customer property, are tracked separately from company holdings and are not lent or otherwise used without customer instructions, Coinbase said.
The overview also describes time-limited access to production systems and phishing-resistant authentication. Sensitive actions require independent verification and multiple approvals, the company said.
Binance’s Attack Put Transaction Signing Under Scrutiny
The emphasis on authorization comes as Binance investigates a breach it valued at approximately $6.34 billion. Its November 3 initial report said attackers obtained unauthorized access to an internal wallet-signing service and initiated transactions outside the normal withdrawal process.
Binance described a campaign involving fake recruitment interviews, malware and compromised employee devices. On Ethereum, the attackers used signed EIP-7702 permissions to give a malicious contract execution rights over a hot wallet. Those onchain permissions remained effective after ordinary withdrawals were suspended, requiring separate revocation transactions.
Binance also said it had rebuilt the affected wallet systems and was engaging outside security firms to review the incident and validate its preliminary findings.
CoinScreamer’s attack timeline follows that sequence. Our withdrawal update covers Binance’s phased reopening and its commitment to absorb losses using company resources.
Insurance Has Its Own Scope
Coinbase’s insurance overview says its crime policy covers a portion of digital assets against theft, including cybersecurity breaches. It excludes losses from unauthorized access to a personal account caused by compromised or lost credentials.
The company also says losses in a covered incident could exceed insurance recoveries. Cryptocurrency held on the platform does not receive FDIC or SIPC protection; arrangements for eligible cash balances or brokerage securities are separate.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
