Coinbase says 99% of customer crypto is offline after Binance hack
ITF Team2 min read
Coinbase confirms over 99% of customer assets are stored in cold wallets, detailing split keys and kill‑switches as it reassures users following the $6.4 bn Binance breach on Nov 3 2026.
Key takeaways
- Coinbase stores more than 99% of customer crypto in offline cold storage.
- The Binance hack on Nov 3 2026 resulted in about $6.4 bn stolen from hot wallets.
- Coinbase uses split private keys, withdrawal limits and kill‑switches to protect assets.
- Customer assets on Coinbase are held 1:1 and are not lent out without explicit consent.
On November 4, 2026, Coinbase announced that over 99% of its customers’ cryptocurrency holdings are kept in offline cold storage, a move aimed at calming concerns after the $6.4 billion Binance hack earlier that week. The U.S. exchange emphasized that its security architecture prevents the kind of hot‑wallet breach that crippled its rival.
How Coinbase’s storage model works
Cold wallets are physically isolated from the internet, meaning hackers cannot reach them through typical network attacks. Coinbase only moves funds into hot wallets when a withdrawal request is received, limiting exposure time. The exchange also splits private keys for these cold wallets into multiple parts, ensuring no single person can reconstruct a full signing key.
In addition, no employee has standing access to the hot‑wallet signing service. Withdrawal requests are throttled by strict rate limits, and any abnormal spike triggers a manual review. If needed, a “kill switch” can instantly take signing keys offline, halting all transaction processing.
Why the announcement matters now
The Binance incident, attributed by the FBI to North Korea’s TraderTraitor group, saw attackers drain roughly $6.4 bn from hot wallets in under four days. The rapid loss highlighted the vulnerability of assets kept online. By contrast, Coinbase’s cold‑storage emphasis demonstrates a defensive posture that reduces the attack surface.
Coinbase also flagged artificial intelligence as an emerging threat, noting that phishing attacks on employees could compromise credentials. Its layered controls require multiple approvals for sensitive actions, making a stolen password insufficient for unauthorized withdrawals.
Read also: Crypto market rebounds 4% after US midterm election results
Recent security incidents in the crypto space
Beyond Binance, other platforms have suffered breaches: Brazil’s Mercado Bitcoin halted withdrawals after a $40 million hack, and France’s Crédit Mutuel Arkéa reported a $133 million theft. In May 2025, Coinbase disclosed a bribery scheme involving overseas support agents that targeted less than 1% of its users, though it refused a $20 million ransom.
These events underscore the industry‑wide pressure on exchanges to prove robust custodial safeguards. Coinbase’s disclosure of $8.6 bn in cash and cash equivalents and $377 bn in total assets as of September 30, 2026, reinforces its capacity to absorb shocks while keeping customer funds separate and un‑lent unless expressly authorized.
What traders should monitor
While Coinbase does not lend customer assets by default, any future changes to its custody policy could affect liquidity and market perception. Traders should watch for updates on the kill‑switch protocol, any regulatory guidance on cold‑storage ratios, and the evolution of AI‑driven phishing tactics.
- Watch for Coinbase’s quarterly security‑risk report (expected Q1 2027).
- Monitor regulatory filings on custodial standards in the U.S. and EU.
- Track any new phishing‑related incidents targeting exchange staff.
Frequently asked questions
How much of Coinbase’s crypto is stored offline?
Coinbase states that more than 99% of customer cryptocurrency is kept in cold storage, meaning the wallets are not connected to the internet and cannot be accessed by online attackers.
What security layers does Coinbase use to protect hot‑wallet withdrawals?
The exchange splits private keys, imposes strict withdrawal rate limits, runs anomaly‑detection on spikes, requires multiple approvals for sensitive actions, and can activate a kill‑switch that takes signing keys offline.
Related news
- Crypto market rebounds 4% after US midterm election results
- Democrats midterm victory drives dollar slide and gold rally in market overview
- Bitcoin price forecast: US midterm elections could trigger volatility shock
- Gold reclaims $4,000 after US election
More from ITF
This article is compiled from international market news for information only. It is not investment advice.