Coinbase says it wasn't hit by Binance hack, keeps over 99% of assets offline
In brief
- Coinbase said it wasn't affected by last week's Binance hack, according to Decrypt.
- Attackers drained about $6.4 billion from Binance's hot wallets, Decrypt reported.
- Over 99% of Coinbase customer assets sit in offline cold storage, the company says.
- Coinbase described controls including split private keys, withdrawal limits and kill switches.
- Coinbase reported $8.6 billion in cash and $377 billion in platform assets as of Sept. 30.
What Coinbase says it does
According to Coinbase's blog post, as reported by Decrypt, funds move into internet-connected hot wallets only as customers need them. Everything else stays cold.
The key handling matters most. Coinbase said private keys for its cold wallets are split into pieces and never fully reassembled, even when signing transactions, and that no single employee has standing access to its hot-wallet signing service. Strict limits cap how fast funds can move from cold to hot wallets, and unusual withdrawal spikes are held until staff review them. The exchange said it can also trigger "kill switches" that take signing keys offline entirely.
Coinbase said it assumes employees will be targeted by phishing, so its controls are built so a stolen password, session or device can't be used on its own (sensitive actions require multiple approvals).
These are Coinbase's own descriptions of its setup.
The Binance incident “has understandably left customers asking” how Coinbase guards against a similar attack, the post said.
The Binance backdrop
The FBI has attributed the Binance theft to North Korea's TraderTraitor group, Decrypt reported. Blockchain analytics firm Elliptic found the laundering spanned about 12,000 wallets in under four days, and stablecoin issuers froze about 44% of the haul. Decrypt also noted that Brazil's Mercado Bitcoin halted withdrawals after a $40 million hack, while French bank Crédit Mutuel Arkéa confirmed a cyberattack that led to a $133 million crypto theft.
Coinbase's own record
Coinbase isn't new to security incidents. In May 2025 it disclosed that criminals had bribed overseas customer support agents to steal personal data on less than 1% of monthly transacting users, then demanded a $20 million ransom that Coinbase refused to pay. Last week, it said an incident at analytics vendor Amplitude exposed contact data for a "small subset" of customers; funds weren't affected, the company said.
Coinbase also said customer assets are held 1:1 and aren't lent out unless customers direct it to. It reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30.
The company flagged artificial intelligence as a fast-changing threat and pledged further security investment.
Frequently asked questions
How does Coinbase say it protects customer crypto from hacks?
Coinbase said it keeps more than 99% of customer assets in offline cold storage and moves funds to hot wallets only as customers need them. It said cold-wallet private keys are split into pieces and never fully reassembled, and that it can trigger kill switches that take signing keys offline.
Was Coinbase affected by the Binance hack?
Coinbase said in a Wednesday blog post that it wasn't affected by last week's Binance hack. Decrypt reported that attackers drained about $6.4 billion from Binance's hot wallets, and the FBI has attributed the theft to North Korea's TraderTraitor group.
