Coinbase has announced that it stores more than 99% of customer assets in cold storage. This disclosure comes shortly after Binance reported a large-scale security breach that resulted in a loss of $6.3 billion on October 29.
Security measures at Coinbase
Coinbase, established in 2012 and now one of the largest US-based cryptocurrency exchanges, clarified its asset protection strategy via a recent company blog post. The platform explained that it keeps only a small fraction of user funds in online hot wallets, necessary for daily withdrawals, while the overwhelming majority remains in offline cold storage.
The exchange also stated that its Custody vault operates entirely offline and ensures assets are kept segregated on-chain. To further enhance security, Coinbase splits private keys into multiple segments, limiting individual access and reducing the risk of any single compromised component triggering a breach.
In addition, Coinbase has implemented measures that slow down the process of moving assets from cold storage to hot wallets. Systems are in place to pause withdrawals if suspicious activity is detected, and emergency kill switches can bring signing keys offline immediately.
Coinbase reported that all customer holdings are maintained on a 1:1 basis and are never lent out unless instructed by users. However, these procedures have not been independently verified for this report.
Lessons from the Binance breach
The recent hack at Binance exposed weaknesses in fundamental security procedures across major exchanges. Attackers reportedly targeted Binance by exploiting human error, including a tampered software download and a fake job interview, which allowed them to access sensitive wallet systems using stolen credentials and an internal artificial intelligence tool.
In the attack, 233.46 million XRP tokens were drained from five hot wallets within four minutes. Binance was able to freeze or intercept about $2.85 billion, but the breach continued for almost four hours, resulting in considerable losses.
| Exchange | Amount Stolen | Assets Targeted | Response Time | Funds Frozen/Recovered |
|---|---|---|---|---|
| Binance | $6.3 billion | XRP, others | 4 minutes (initial transfer), 4 hours (total duration) | $2.85 billion |
| Coinbase | No major breach reported | None | — | — |
Matt Hougan, Chief Investment Officer at Bitwise, noted that hot wallets inevitably represent a vulnerable point within the custodial system. He stated,
Hot wallets are, by design, the least-protected part of the system.
Although most of Binance’s holdings remained safe in cold storage, attackers focused on the smaller, less secure hot wallet balances. Security consultants at NCC Group have highlighted that truly robust security demands more than offline storage; organizations must ensure that no single employee, if compromised, can authorize large movements of funds.
Mini dictionary: NCC Group is a global cybersecurity firm that specializes in risk assessment, IT security, and advising on digital asset protection.
Cold storage versus cold custody
Industry participants note a distinction between cold storage and cold custody. While cold storage simply keeps private keys offline, cold custody includes added layers, such as independent transaction approvals, divided authority among several individuals, physical security protocols, and formal oversight policies.
AMINA Bank, a Swiss financial institution focused on digital assets, stresses that this difference ensures one compromised employee or system cannot authorize an unauthorized transfer, even if the private key itself remains secure offline.
Institutional adoption and regulatory landscape
Demand for enhanced custodial security had been rising even before the Binance incident. According to a January survey by Coinbase and EY-Parthenon, 66% of 351 institutional investors cited security and key-signing policies as a primary factor when selecting a custodian, marking a significant increase from 8% the previous year.
The same survey found that regulatory compliance also rose in priority, with 66% of respondents emphasizing it, compared to just 25% a year prior. Despite high-profile hacks, institutional investors remained committed to increasing digital asset exposure, with 73% planning to expand their portfolios.
Boston Consulting Group considers custody a critical component of financial infrastructure for banks dealing with digital assets. In their view, robust protection requires not only secure storage but also reliable approval and oversight mechanisms, as well as options to work with multiple custodians to manage risk effectively.
There are currently no global rules mandating exchanges to keep a set percentage of assets offline. The International Organization of Securities Commissions (IOSCO) stresses the importance of safeguarding client assets, maintaining segregation, and conducting independent audits.
Market response and outlook
Despite the dramatic nature of the Binance hack, there has been no clear sign of long-term shifts in user behavior. The incident’s short-term market impact was limited: Bitcoin dropped approximately 4% the next day, moving in line with a 3% decline in the Nasdaq-100.
Looking ahead, market research firm Grand View Research projects that the crypto-wallet sector’s value will expand from $15.5 billion in 2025 to $100.8 billion by 2033. This forecast includes both hot and cold wallets and does not necessarily suggest a broad movement toward exclusive use of cold custody solutions.
