Coinbase’s Vault Stays Cold as Binance’s $6.34B Hack Lights Up the Industry 🔐

Coinbase said it was unaffected by the October 29 Binance hack, in which attackers reportedly accessed an internal wallet-signing service and moved about $6.34 billion in assets outside the exchange’s normal withdrawal process. The exchange said more than 99% of customer assets are held in cold storage, with limited hot-wallet balances used to process deposits and withdrawals.

In a blog post Wednesday, Coinbase detailed a security system built around offline storage and multiparty computation (MPC), which separates cryptographic signing authority among multiple participants so a complete private key is not kept in one location. Its safeguards include distributed signing keys, withdrawal limits, unusual-activity detection, transaction-signing controls and “kill switches” that can take signing keys offline entirely.

Coinbase said no single employee has standing access to the hot-wallet signing service, while strict limits control how quickly funds can move from cold to hot wallets. Withdrawal spikes can be held for staff review, and sensitive actions require multiple approvals. The exchange said it assumes employees may be targeted through phishing, meaning a stolen password, session or device cannot be used on its own to authorize transactions.

The company said customers retain ownership of their digital assets, which are held 1:1 and are not lent or otherwise used without explicit customer instructions. Coinbase reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform as of Sept. 30. It also acknowledged that criminals bribed overseas customer-support agents to steal personal data on less than 1% of its monthly transacting users in May 2025; the company refused a $20 million ransom, and the incident could cost up to $400 million. A later security incident involving analytics vendor Amplitude exposed contact data for a “small subset” of customers, but funds were not affected.

The Binance theft, attributed by the FBI to North Korea’s TraderTraitor group, has prompted wider scrutiny of exchange security. Elliptic said laundering spanned about 12,000 wallets in under four days, while stablecoin issuers froze about 44% of the haul. Separately, Brazil’s Mercado Bitcoin halted withdrawals after a $40 million hack, and French bank Crédit Mutuel Arkéa confirmed a cyberattack that enabled fraudulent operations, saying customers’ assets were not affected.