Coinbase says 99% of assets in cold storage after breach

Coinbase stated on November 4 that it was not affected by the reported Binance hot-wallet incident and that more than 99% of customer assets are held in cold storage. The exchange published a security explanation outlining its internal controls, including distributed signing keys, withdrawal limits, and anomaly detection systems.

Cold Storage and Signing Controls

Cold storage is defined as arrangements designed to keep signing authority away from routine internet-connected systems. This structure aims to reduce the exposure of a custodian’s largest reserves if a hot wallet or application layer is compromised. While hot wallets remain useful for normal withdrawals, the balance between operational liquidity and offline custody is a central design consideration for exchanges.

Coinbase described its use of distributed signing keys, a mechanism where no single compromised system can authorize a large movement of funds if the policy is well implemented. The company also detailed withdrawal limits and anomaly detection tools that add layers of protection, potentially buying time when a transaction appears unusual. Emergency controls are capable of stopping transaction signing entirely.

The reported figure of more than 99% in cold storage is described as Coinbase’s stated current practice. It is not a universal guarantee that every customer balance is insulated from every type of problem. Risks separate from cold storage include account takeover, internal controls failures, fraud, software defects, and legal restrictions. A security system is strongest when the organization explains the entire chain of access rather than relying on a single percentage.

Industry Response and User Due Diligence

The disclosure comes as industry participants investigate the reported multi-billion-dollar Binance exploit. Stablecoin issuers have described the actions available to them once assets have left a platform. These are connected but distinct defences: custody aims to stop unauthorized signing, while downstream tracing and freezes aim to limit damage after funds move.

Operational controls in decentralized finance can also reduce further exposure during an incident. For example, Aave restricted new tBTC supply and borrowing, a move that highlights how explicit scope and independent checking of controls are useful during an active security event.

Exchange users are advised to ask whether balances are fully backed and what proportion is held in internet-connected wallets. They should also inquire how withdrawals are approved and whether controls are independently assessed. Understanding the difference between assets held by a platform and tokens in a personal wallet where the user controls the private keys is essential for assessing personal risk.