BTC $80,273 
ETH $2,420 
MGLOEURO $111,813 
USDT $0.9994 
BNB $716.47 
XRP $1.32 
USDC $0.9998 
SOL $96.63 
TRX $0.3184 
FIGR_HELOC $1.05 Hacks & Security · News brief
Coinbase says over 99% of customer crypto sits in cold storage
After Binance's multibillion-dollar hot-wallet breach, Coinbase detailed layered defenses it says limit exposure to online attacks.
Key takeaways
- Mostly offline. Coinbase says over 99% of customer assets are held in cold storage rather than internet-connected hot wallets.
- Not affected. The exchange said the Binance breach did not touch its platform.
- Insider focus. Controls are built so a stolen password, session or device cannot be used alone, and sensitive actions need multiple approvals.
What happened
Coinbase has published a blog post aimed at reassuring customers about how it protects their holdings, saying it was not affected by the recent breach at rival exchange Binance. In the post, published Wednesday, the U.S. exchange said more than 99% of customer assets are kept in cold storage, meaning wallets held offline and not reachable over the internet. Funds are shifted into connected hot wallets only when customers need them, according to the company.
The exchange said the Binance incident had understandably prompted customers to ask how Coinbase guards against a similar attack, and it used the post to walk through several layers of protection. Private keys for cold wallets are divided into pieces that are never fully reassembled, even while transactions are being signed, and no single employee has standing access to the hot-wallet signing service, Coinbase said.
Coinbase also described limits on how quickly funds can move from cold to hot wallets, and said unusual spikes in withdrawals are held until staff review them. The company said it can trigger kill switches that take signing keys offline entirely. It added that it assumes employees will be targeted by phishing, so its controls are designed so that a stolen password, session or device cannot be used on its own, and sensitive actions require multiple approvals.
The post also stated that customer assets are held on a 1:1 basis and are not lent out unless customers direct it. Coinbase reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30. It flagged artificial intelligence as a fast-changing threat and pledged further investment in security. The disclosure was reported by Decrypt and ZyCrypto.
