Coinbase elaborates on its security strategy: over 99% of customer assets are stored in cold wallets

Author | Coinbase

Compiled by | Wu Says Blockchain

The content of this article does not constitute any investment or financial advice. Readers are advised to strictly comply with the laws and regulations of their location.

TL;DR:

Coinbase stated that it was not affected by the recent reports of the Binance hot wallet security incident and currently stores over 99% of customer assets in cold wallets, allocating hot wallet funds based on customer deposit and withdrawal needs. Asset transfers are protected by multiple layers, including distributed key protection, withdrawal limits, anomaly detection, and an emergency switch that can immediately stop signatures. We hold customer assets on a 1:1 basis, with ownership belonging to the customers. We only lend or use these assets when explicitly instructed by the customers. The rapid development of artificial intelligence is changing the security landscape, and Coinbase will continue to invest in the research and development of advanced security technologies.

Below is the full text of the article released by Coinbase:

The reports regarding the Binance hot wallet security incident have led some customers to begin to question how Coinbase protects customer assets and prevents similar incidents. This incident did not affect Coinbase's systems or customer funds. This article will introduce how Coinbase's institutional-grade multi-layer protection system works and how we protect different types of customer assets across various products through this system.

Coinbase uses both hot wallets and cold wallets for storage. Hot wallets only hold a small amount of assets for customers to withdraw at any time or use outside the Coinbase platform. Currently, over 99% of customer assets are stored in cold wallets. We actively allocate and closely monitor hot wallet balances through operational personnel, software services, and cryptographic systems to timely meet customers' changing funding needs while continuously transferring excess funds to cold wallets. Our dedicated Custody vault product employs the same security system as institutional custody services, with all assets stored in cold wallets and isolated on-chain.

Properly securing wallets is only part of the custody work; every wallet transaction also requires security verification. Coinbase has implemented multiple control measures for both hot and cold wallets to verify that fund transfers meet predetermined purposes. Specific measures include:

• Distributed key protection: In the cold wallet custody process, all wallet private keys corresponding to customer assets are split into multiple shards, and even during the signing process, the complete private key is never reconstructed. In terms of hot wallets, no individual has permanent access to the production environment of the wallet signing service, and any changes to that service require the involvement of multiple personnel. Both hot and cold wallets employ security designs that avoid single points of failure. Even if an attacker steals a laptop, breaches a server, or has an insider act maliciously, they cannot complete a signature or reconstruct the wallet private key based solely on that.

• Transfer rate limits and anomaly detection: To meet customer trading needs, we replenish funds from cold wallets to hot wallets and strictly limit transfer speeds. When withdrawal volumes trigger alerts, or if an account, wallet, asset, or network shows anomalies, the wallet operations team investigates suspicious activities, and related transactions must be verified before proceeding. A surge in transfer volume may stem from active market trading on that day or may signal an anomaly. The limit mechanism will prevent abnormal amounts of funds from being transferred from cold wallets to hot wallets until staff confirm that activities are normal.

• Emergency stop mechanism: Once an anomaly is detected, we can immediately suspend part or all fund transfers. Some emergency switches can block signatures from a cryptographic level. We will take the signing keys completely offline, and before access is actively restored, no system can use these keys for signing, even if the system has been compromised. We will only restore key access after reviewing and confirming that the affected system is intact, the cause of the issue has been identified, and the vault can safely resume operations.

We also take the following measures throughout the technical environment to reduce the risk of a single malicious actor executing sensitive operations alone:

• Restrict permanent access: Whenever conditions allow, we will revoke permanent access to production services. Personnel will only be granted temporary access through a secure instant authorization mechanism when they need to access production services, and access duration will be limited.

• Enforce multi-party confirmation: Operations such as deploying code changes to the production environment or granting new role permissions require multi-party confirmation through software or cryptographic mechanisms, combined with multi-factor authentication, to ensure that a single user cannot act alone.

• Implement specialized management for high-privilege positions: We classify positions that can access fund transfer functions in the production environment as highly sensitive. Relevant personnel must undergo stricter background checks, and their operations are subject to closer monitoring.

• Mitigate the impact of phishing attacks: When designing protective measures, we assume that employees will be targets of phishing attacks. In addition to conducting anti-phishing training, we also implement technical measures to ensure that attackers cannot execute operations solely based on stolen passwords, login sessions, or devices. A phishing-resistant authentication method must be used for login, and sensitive operations require independent verification and multi-party approval. Monitoring systems continuously monitor employee accounts, and any detected abnormal activity will trigger alerts to the global security operations center.

Coinbase holds customer assets on a 1:1 basis, with ownership always belonging to the customers. Coinbase will only lend or use these assets when explicitly instructed by the customers. We maintain separate records for customer assets and company-owned assets.

Coinbase is a publicly traded company headquartered in the United States and is a component of the S&P 500 index. Our financial statements are reviewed by external auditors every quarter. We also submit audited annual financial statements to the U.S. Securities and Exchange Commission (SEC). Coinbase is regulated in multiple jurisdictions worldwide and holds over 80 licenses. As of September 30, 2026, we hold $8.6 billion in cash and cash equivalents, as well as $2.2 billion in investment-grade crypto assets, with total platform assets amounting to $377 billion.

Coinbase must adhere to standards equivalent to those of large global financial institutions. Our U.S. custodian, Coinbase Custody Trust Company, has fiduciary obligations under New York state law and is a qualified custodian regulated by the New York State Department of Financial Services (NYDFS). The NYDFS is also responsible for regulating banks in New York State. In Europe, Coinbase has obtained authorization under the Markets in Crypto-Assets Regulation (MiCA) framework and is regulated by the Luxembourg Financial Industry Supervisory Commission (CSSF), allowing us to provide services to customers across the EU under a unified regulatory framework. We are also one of the first crypto asset custodians to complete SOC 1 Type II and SOC 2 Type II attestations. These attestations verify the effectiveness of various control measures in actual operation.

Our Chief Security Officer, Jeff Lunglhofer, previously served as the Chief Information Security Officer at BNY Mellon. His team includes security engineers, cryptography experts, threat intelligence analysts, and investigators. Team members have work experience in financial services, national security, and law enforcement, dedicated to protecting customer assets and the systems that safeguard these assets.