Coinbase Details $377 Billion Protection Strategy Following Binance's $6.3B Hack

According to Coinbase, over 99% of user crypto is kept in offline cold storage. This is the firm's response to a $6.3 billion hack suffered by competitor Binance.

Binance has stated that the hackers did not gain access to its private keys, instead tricking its withdrawal approval systems. Separately, research indicates that Coinbase manages 84% of US spot Bitcoin ETF assets.

Coinbase's Approach to Customer Fund Protection

At the end of September, Coinbase reported holding $377 billion in assets. The exchange emphasizes that these funds are customer property, not corporate money.

“Coinbase does not lend or use those assets unless customers instruct us to.”

Coinbase also highlights its S&P 500 listing and routine audits. Additionally, its US custody business is overseen by the New York banking regulator.

The exchange outlines several key safeguards.

• Segregated accounts are the primary protection.

Coinbase records the $377 billion separately from its own $8.6 billion in cash and $2.2 billion in crypto, based on its most recent quarterly report.

• Fiduciary responsibility comes next.

Its New York custody unit serves as a qualified custodian and fiduciary, legally obligated to prioritize client interests. In Europe, Coinbase is supervised by Luxembourg's financial regulator under the MiCA framework.

• External audits form the third barrier.

Coinbase states it was an early crypto custodian to pass SOC 1 and SOC 2 Type II audits. These assessments confirm that its security controls function correctly.

• Personnel represent the ultimate safety net.

Chief Security Officer Jeff Lunglhofer formerly oversaw information security at BNY. His workforce of cryptographers and investigators has backgrounds in finance, national security, and law enforcement.

How Hackers Stole $6.3 Billion from Binance Without Touching Private Keys

According to Binance, the breach originated with a counterfeit job interview. The attackers subsequently accessed employee computers and submitted fraudulent withdrawal approvals on October 29.

On November 1, BeInCrypto noted that the Binance, Bybit, and Bitget incidents shared a common approach. In each case, the exchanges' withdrawal authorization systems were deceived. No private keys were compromised.

The report also compared Coinbase's security framework to that pattern. Coinbase employs multi-party computation (MPC), breaking private keys into fragments distributed across multiple machines. Additionally, Coinbase develops its security software internally, unlike Bybit and Bitget, which relied on external vendors. Researchers contend that a compromised Coinbase laptop would provide hackers with just a single, useless key fragment.

Still, Coinbase has faced attacks in the past. In 2025, criminals bribed foreign support personnel for customer information. The exchange pegged the resulting losses at up to $400 million.

A recent blog post from the firm cautions that artificial intelligence (AI) is transforming attack methods.

Does Storing Crypto Offline Justify Slower Processing Speeds?

Elsewhere, South Korean local media reported that the Financial Services Commission told exchanges this week to exceed the legal 80% offline storage floor. The Herald Business stated that Upbit already had 99.17% of its funds in cold storage.

However, transactions move slowly when funds are offline. The Seoul Shinmun reported that Bithumb experienced a 13-hour withdrawal backlog in August when its hot wallet was emptied.

Korean trading platforms caution that more security personnel will push costs higher. Newsway reported that smaller exchanges might not be able to afford this, potentially driving users toward the largest operators.