Coinbase Outlines Safeguards for Customer Crypto After Binance Hack

Highlights

Coinbase said it was not affected by the Binance hack and keeps more than 99% of customer assets in offline cold storage, transferring funds to internet-connected wallets as needed. Its safeguards include divided private keys, limits on transfers, anomaly detection, multiple approvals, and emergency measures that can disable signing keys. Coinbase also said customer assets are held 1:1 and are not lent out unless customers direct it to. The company presented layered controls—not cold storage alone—as central to limiting the impact of a security breach. It also identified artificial intelligence as a rapidly changing security concern.

Sentiment Analysis

• The article has a cautiously reassuring tone: Coinbase describes controls intended to protect customer funds and says the Binance incident did not affect its operations.


• That reassurance is qualified rather than absolute. The account emphasizes that security depends on multiple procedures, including offline storage, restricted access, review of unusual withdrawals, and the ability to take signing keys offline.


• References to Coinbase’s May 2025 disclosure about bribed overseas support agents, as well as a separate vendor incident, introduce a more critical and risk-aware dimension. These examples show that threats can involve people and service providers, not only direct attacks on wallets.


• The broader industry context is distinctly concerning, including the Binance theft and other reported crypto-related incidents. However, the article does not claim that every exchange faces identical risks or that Coinbase’s controls guarantee safety.


• Overall, sentiment is mixed but leans cautiously positive toward Coinbase’s stated preparations, while recognizing significant and evolving cybersecurity threats. The visual indicator reflects this guarded reassurance rather than certainty.

Article Text

Coinbase has described its security practices in response to questions raised by a major theft at rival exchange Binance. In a blog post published Wednesday, the U.S. exchange said it was not affected by last week’s incident, in which attackers drained about $6.4 billion from Binance hot wallets. Coinbase said the event had understandably led customers to ask how it protects assets against comparable attacks.

The company said more than 99% of customer assets are held in cold storage. These wallets are offline and cannot be reached over the internet. Coinbase moves funds into internet-connected hot wallets only when customers need them. This approach reduces the amount of customer crypto exposed to online systems at any given time, but Coinbase describes it as one part of a broader set of safeguards.

Coinbase outlined controls for managing private keys and authorizing transactions. Private keys used for cold wallets are divided into pieces and, according to the company, are never fully reassembled, even when transactions are signed. The exchange also said no single employee has standing access to the hot-wallet signing service. These arrangements are intended to prevent one compromised account or individual from having unrestricted control over funds.

Limits govern how quickly assets can move from cold wallets to hot wallets. The company said unusual spikes in withdrawal requests are held for staff review. It can also activate “kill switches” that take signing keys offline entirely. Together, these measures are designed to slow suspicious activity and give security teams a chance to investigate before funds move further.

Coinbase said it assumes employees will be targeted by phishing attempts. Its systems are intended to prevent a stolen password, session, or device from being sufficient by itself to carry out sensitive actions. The company said such actions require multiple approvals. This focus on insider and account-compromise risks is particularly relevant given the exchange’s own prior disclosures.

In May 2025, Coinbase disclosed that criminals had bribed overseas customer support agents to obtain personal data on less than 1% of its monthly transacting users. The criminals then demanded a $20 million ransom, which Coinbase said it refused to pay. Last week, the company also reported that a security incident at analytics vendor Amplitude exposed contact data for a “small subset” of customers. Coinbase said customer funds were not affected in that incident.

The exchange stated that customer assets are held 1:1 and are not lent out unless customers direct it to do so. As of Sept. 30, it reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform. These figures describe the company’s reported financial and platform position at that date; they do not by themselves guarantee that a security incident cannot occur.

Coinbase also identified artificial intelligence as a fast-changing security threat and said it would continue investing in security. The company did not present AI as a single, specific attack but highlighted the changing risk landscape. The statement places its wallet controls alongside a broader need to adapt as methods used by attackers change.

The Binance theft has unsettled the wider crypto industry. The FBI attributed the incident to North Korea’s TraderTraitor group. Blockchain analytics firm Elliptic found that laundering activity spanned about 12,000 wallets in under four days, while stablecoin issuers froze about 44% of the haul. These details illustrate both the scale and speed of activity following the theft, as well as the role that monitoring and asset controls can play in response.

Other recent incidents underscore that security problems extend beyond one exchange. Brazil’s Mercado Bitcoin halted withdrawals after a $40 million hack. French bank Crédit Mutuel Arkéa also recently confirmed a cyberattack that led to a $133 million crypto theft. The incidents differ in their circumstances, but collectively provide context for why exchanges and financial institutions face continued pressure to protect digital assets and customer information.

Coinbase’s account is therefore a description of its stated defenses, not a claim that it is immune to attacks. Its measures combine offline custody, divided keys, limited access, withdrawal monitoring, review procedures, and emergency controls. The company’s previous disclosures also show that third-party services and employee targeting form part of the risk picture. The central issue for customers is how these controls operate together and how consistently they are updated as threats evolve.

Key Insights Table