Over 99% of Coinbase Customer Assets Held in Offline Wallets Following $6.34B Binance Breach

Key Points

Table of Contents

The exchange maintains more than 99% of customer cryptocurrency holdings in offline cold wallet storage.
Coinbase confirmed that the $6.34 billion Binance security breach had zero impact on its infrastructure or customer holdings.
Binance successfully froze or recovered approximately $2.85 billion and restored 98% of the affected digital assets.
The platform held $376.6 billion in total assets as of September 30, 2026.
Regulatory authorities in South Korea called for cryptocurrency platforms to exceed the current 80% cold storage mandate.

Following the $6.34 billion security breach at Binance on October 29, Coinbase disclosed that it maintains more than 99% of customer cryptocurrency in cold storage. These offline wallets restrict internet connectivity. The exchange confirmed that the incident did not compromise its infrastructure or any customer holdings. The attack has sparked broader conversations about authorization processes for large-scale transfers.

Exchange Describes Multi-Layer Security Framework

Coinbase stores the majority of customer digital assets offline while maintaining hot wallets to process withdrawal requests. The platform implements multiple safeguards for fund movements, including transaction limits, monitoring systems that flag abnormal activity, and mechanisms to halt approval processes.

The company employs a distributed key architecture where signing keys are fragmented across separate systems. This approach ensures that no individual person or single machine possesses a complete key. Coinbase maintains a one-to-one backing for customer assets and does not engage in lending activities without explicit authorization. The custody operations operate under the supervision of New York state financial regulators.

Attack Vector Focused on Approval Mechanisms

Binance revealed that threat actors gained entry to its wallet-signing infrastructure by compromising employee workstations through malicious software downloads and a fraudulent recruitment interview. The exchange’s account of the October incident explains how stolen authentication credentials enabled unauthorized fund transfers that bypassed standard withdrawal protocols.

By November 3, the platform reported that approximately $2.85 billion had been successfully frozen or intercepted. Binance announced it had replenished 98% of the compromised token holdings and committed to covering all customer losses.

The breach centered on exploiting transaction authorization systems rather than directly stealing private keys. Offline storage measures alone cannot prevent misuse of legitimate signing processes.

Broader Industry Faces Security Scrutiny

Brazil-based Mercado Bitcoin experienced a November 2 incident involving roughly $38 million. The exchange announced plans to reimburse customers following suspicious transfers detected across multiple blockchain networks.

Coinbase’s September filing showed $376.6 billion in platform assets. The company separately held $8.6 billion in corporate cash reserves and $2.2 billion in proprietary cryptocurrency investments, distinct from customer funds.

Industry analysis suggests that Coinbase serves as custodian for approximately 84% of US spot Bitcoin ETF assets. The company previously disclosed that a 2025 data breach involving support personnel could result in losses reaching $400 million.

Regulators in South Korea Call for Enhanced Standards

South Korea’s financial oversight body recommended that exchanges increase offline cryptocurrency holdings beyond current thresholds following the Binance incident. Present regulations mandate a minimum of 80% cold storage, while Upbit maintained 99.17% at the close of September.

As Binance resumed normal operations, the platform warned users about withdrawal scams, including fraudulent offers promising expedited transfers in exchange for payment. Increased reliance on offline storage can extend processing times for withdrawals. Bithumb customers experienced withdrawal delays surpassing 13 hours in August when hot wallet reserves were depleted.