Cold Storage Rallies After Binance’s $6.36B Hot-Wallet Heist 🔐

Coinbase said more than 99% of customer assets remain in cold storage and that it was unaffected by the October 29 Binance hack, in which attackers reportedly accessed an internal wallet signing service and moved assets outside the exchange’s normal withdrawal process. Estimates of the loss varied, with reports citing $6.34 billion, about $6.4 billion and approximately $6.36 billion; TRM Labs said most of the funds moved in about 20 minutes. Coinbase keeps limited internet-connected hot-wallet balances for customer deposits and withdrawals and continuously rebalances excess assets into offline storage.

The U.S. exchange detailed several safeguards in a Wednesday blog post: distributed signing keys, withdrawal limits, unusual activity detection, controls that can halt transaction signing and “kill switches” that take signing keys offline entirely. “Binance’s reported hot wallet incident has understandably left customers asking how Coinbase protects customer assets from something similar happening here,” Coinbase wrote. Its multiparty computation architecture separates cryptographic signing authority among participants, allowing transactions to be approved without a complete private key being assembled in one location, while sensitive actions require multiple approvals. The company said no single employee has standing access to the hot-wallet signing service and that stolen passwords, sessions or devices cannot be used on their own.

Coinbase also said customer assets are held on a 1:1 basis and are not lent out unless customers direct it to, while internal records track account balances and transactions. As of Sept. 30, it reported $8.6 billion in cash and cash equivalents and $377 billion in assets on its platform. The disclosure followed a May 2025 incident in which criminals bribed overseas customer support agents to steal personal data belonging to less than 1% of monthly transacting users; Coinbase refused a $20 million ransom. Last week, the exchange said a security incident at analytics vendor Amplitude exposed contact data for a “small subset” of customers, though funds were not affected.

Other exchanges published storage ratios as the industry responded. Gate launched a “Proof of Security” (PoSEC) framework reporting 88.26% of total assets in cold storage and 11.74% in hot wallets, with cold storage covering 104.58% of customer assets even if hot wallets were fully drained; the data remains under third-party audit review. Upbit reported 99.17% in cold wallets and 0.83% in hot wallets as of September 2026, saying its target is to keep hot-wallet holdings below 1% of customer digital assets. South Korean regulator figures put Bithumb at 94.76%, Coinone at 85%, Digital X, formerly Korbit, at 82.79%, and GOPAX at 80.54% at the end of September, while OKX said more than 95% of client crypto assets were in cold wallets and less than 5% in hot wallets as of Sept. 18, 2026.

The FBI attributed the Binance theft to North Korea’s TraderTraitor group. Elliptic said laundering spanned about 12,000 wallets in under four days, while stablecoin issuers froze about 44% of the haul. Separately, Brazil’s Mercado Bitcoin halted withdrawals after a $40 million hack, and Crédit Mutuel Arkéa confirmed a cyberattack that enabled fraudulent operations but did not affect customers’ assets; the bank said the incident was “closed and now under control” as operations resumed gradually.