Coinbase Says More Than 99% of Customer Crypto Is Held in Cold Storage

Cold storage is only part of the custody story

Recent exchange breaches have put custody practices back under scrutiny. Coinbase’s response centers on one figure: it says more than 99% of customer assets sit in cold storage, away from internet-connected systems. That leaves a small share online for platform operations, while underscoring that offline storage is only one part of its security approach.

The percentage is a useful starting point, but it can’t answer every question customers may have. Cold storage reduces exposure to attacks that target online wallets, yet security also depends on how keys are controlled, how withdrawals are approved, and how quickly suspicious activity is detected. This is more significant than it looks: custody is a chain of controls, and a strong result at one link doesn’t describe the whole chain.

How Coinbase says it protects customer funds

In a blog post published Wednesday, Coinbase said it was not affected by the Binance incident. The company says customer assets are held on a 1:1 basis, remain the property of their owners, and are not lent or used without authorization. Those statements address both custody and the boundary between customer funds and company activity. They describe Coinbase’s position; customers still have to rely on the company’s systems and disclosures to understand how that position is put into practice.

Coinbase describes several safeguards alongside cold storage: private keys are distributed, withdrawals are restricted, and systems monitor for unusual activity. Customers can also use two-factor authentication and hardware security keys. Its Vault feature can require multiple approvals before a withdrawal goes through.

These controls address different points of failure. Authentication can make account access harder to steal, while withdrawal limits and approval steps can slow or block unauthorized transfers; monitoring can help flag activity that doesn’t fit expected patterns. No single measure guarantees safety, and customers’ own account settings matter too. If you're working in this space, the useful question is how these controls interact when an attacker gets past one of them.

The exchange says security requires ongoing work as threats change. It highlighted the rapid development of AI and said it would keep improving safeguards and monitoring for threats. That framing is sensible: defenses can’t be treated as finished simply because assets are stored offline. The statement, however, doesn’t describe specific AI-related threats or changes to its systems, so the claim remains a broad commitment rather than a measurable update.

Scale and context after recent breaches

Coinbase also distinguishes customer funds from company assets. In its latest quarterly filing, it reported about $377 billion in assets held on its platform, compared with $8.6 billion in corporate cash and $2.2 billion in crypto on its own balance sheet. Those figures provide scale, though they don’t by themselves describe how every customer asset is held or protected.

The distinction matters because platform assets and corporate holdings serve different purposes. A large custody total tells readers how much value sits with the exchange, while the company’s own cash and crypto indicate resources on its balance sheet. Neither figure, on its own, establishes the strength of wallet controls or the conditions under which customers could access their assets during an incident. (And this is the part most people overlook.) A headline balance can create an impression of transparency without answering operational questions about access and recovery.

The disclosure followed the October 29 Binance heist, in which about $6.34 billion in cryptocurrency was stolen from internet-connected hot wallets. Binance said Wednesday that it had replenished 98% of the affected assets using its own funds. It also expanded proof-of-reserves coverage to 44 cryptocurrencies.

Replenishing affected assets and expanding proof-of-reserves coverage speak to different concerns. The first addresses recovery after a loss; the second offers information about reserves. Neither fact alone settles broader questions about how a breach occurred or how controls would perform in another incident. That said, both are relevant signals for customers trying to judge an exchange’s response.

A separate reported $45 million attack led Brazilian exchange Mercado Bitcoin to suspend withdrawals. Together, the incidents sharpen a practical question for exchange customers: how much of their holdings is exposed to online systems, and what controls govern access to the rest? A suspension can limit transfers while an exchange responds, but it also shows how quickly an incident can affect customers’ ability to use their funds.

What customers can take from the disclosures

Coinbase’s cold-storage figure and list of safeguards offer a useful account of its stated approach, but they aren’t a complete security audit. Customers can compare what an exchange says about storage, approvals, monitoring, and reserves, then consider whether those disclosures answer the questions they care about. You'll want to distinguish a company’s stated controls from evidence about how they work in practice.

For exchanges, the recent incidents raise the bar for explaining custody in terms customers can assess: where assets are held, who can authorize transfers, and what happens when systems detect suspicious activity. The numbers here are underwhelming as a standalone measure of security. They’re still a starting point. The harder test is whether the controls hold up under pressure.