Coinbase has stated that the $6.34 billion hot-wallet hack at Binance did not affect its own systems or customer funds, noting that more than 99% of client assets are reportedly held in cold storage per TechFlow's report.
Coinbase asserts that client holdings stay fully secured and need authorization before access, while regulators in South Korea have urged domestic platforms to tighten cold storage protocols and withdrawal safeguards. TechFlow reported on Nov. 4 that the American firm holds more than 99 percent of customer funds in cold wallets and modifies hot-wallet balances to handle incoming deposits and outgoing withdrawals.
Custody Safeguards and Cold Storage Ratios
Coinbase's statement outlined protective measures such as distributed signing keys, withdrawal limits, detection of unusual activity, and controls capable of halting transaction signing. This reassurance from Coinbase comes after the October 29 theft at Binance, in which attackers gained access to an internal wallet-signing service and transferred assets outside the exchange's standard withdrawal procedures.
In its published explanation of custody, Coinbase states that customers maintain ownership of digital assets held via its exchange; internal records monitor account activity while the company maintains customer assets at a 1:1 ratio. The exchange asserts that it does not lend or utilize those assets unless customers explicitly instruct it to do so.
Coinbase outlines its storage setup as a blend of disconnected infrastructure and secure multiparty computation, or MPC, a method that splits cryptographic signing credentials across distinct entities. The firm states that each entity keeps just its portion, allowing transaction authorization without gathering the full key in a single location. Every participant verifies transactions according to relevant rules.
These details pertain specifically to hosted Coinbase.com accounts, while those utilizing self-custody wallets manage their own private keys independently. A dedicated security page from the firm highlights safeguards such as two-factor authentication backed by hardware security keys and withdrawal processes needing several approvals via Coinbase Vault. Additionally, the company's insurance summary notes that crime coverage shields a segment of digital assets held in various storage environments from loss due to theft or cyber incidents.
Coinbase states that its insurance coverage does not apply to losses resulting from unauthorized access to personal accounts via stolen or compromised credentials, noting that recoverable amounts from insurers might fall short of total losses from a covered security event. For U.S. customers specifically, cryptocurrency holdings lack protection under the Federal Deposit Insurance Corporation or the Securities Investor Protection Corporation.
Coinbase maintains that customer dollar balances operate under distinct arrangements, utilizing custodial accounts held at financial institutions, short-term U.S. Treasury securities, or money market funds denominated in dollars while adhering to relevant regulations. If these funds are kept as cash within qualifying banks or credit unions, deposit insurance coverage may be passed through following an institution's collapse, provided specific conditions and regulatory findings are met, currently capping protection at $250,000 per depositor.
According to Binance's report released on November 3, the total value of impacted assets reached roughly $6.34 billion, with approximately $2.85 billion noted as frozen or intercepted pending reconciliation and market price adjustments. The firm outlined a multi-stage attack that utilized deceptive job interviews, breached developer tools, and exploited an internal artificial intelligence system prior to gaining access to wallet-signing functions.
Malicious Ethereum authorizations enabled additional transfers separate from the standard withdrawal mechanisms, meaning that halting withdrawals or closing hot-wallet channels did not revoke existing on-chain permissions. To address the breach, the organization reconstructed compromised wallet infrastructure, swapped out hardware, invalidated stolen login details, and upgraded surveillance protocols.
Insurance Limits and Regulatory Responses
Coinbase stated that its customers remained unaffected by the incident at Binance, a detail previously covered by the report regarding the broader market impact. In related regulatory developments, South Korea's Financial Services Commission directed domestic exchanges to reinforce cold-wallet safeguards and financial reserves in response to the Binance event. As reported earlier, Binance finalized reserve verification for ten cryptocurrencies on Nov. 2 utilizing an Oct. 31 snapshot, with the verified assets comprising Bitcoin, Ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.
The regulatory examination examined withdrawal permissions, admin rights, internal access limits, and transaction tracking mechanisms. Rules currently in force require service providers to keep a minimum of 80% of client crypto holdings in cold storage. Information provided to lawmaker Min Byeong-deok by the Financial Supervisory Service revealed that Upbit stored 99.17% of its assets in cold storage at the close of September, with Bithumb following at 94.76% and Coinone at 85%. Officials also asked for ongoing oversight of deposits and withdrawals, the assignment of extra incident-response staff, and protocols for exchanging data concerning suspicious access efforts.