Coinbase touts 99% cold storage as Binance says it has replaced 98% of its $6 billion-plus hack

Six days after Binance lost billions to attackers, its largest U.S. rival put out a blog post explaining why it says the same thing can't easily happen to it. On Wednesday, Coinbase told customers it was not affected by the Binance breach and walked through the controls it uses to keep customer funds out of reach — a post timed, by its own framing, to answer a question the Binance incident "has understandably left customers asking," per the version reported by Decrypt.

The core claim: Coinbase keeps more than 99% of customer assets in cold storage — offline wallets that can't be reached over the internet — moving funds into internet-connected hot wallets only as customers withdraw them, according to both The Block and Decrypt. The company said customer assets are held 1:1, remain customer property, and are not lent or otherwise used without customer authorization.

Coinbase laid out several layers it says sit behind that. Private keys for cold wallets are split into pieces and, per Decrypt, never fully reassembled even when signing a transaction; no single employee has standing access to the hot-wallet signing service. Strict rate limits cap how fast funds can move from cold to hot storage, and unusual withdrawal spikes are held for staff review. The exchange said it can trigger "kill switches" that take signing keys offline entirely. It added that it assumes employees will be phished, so a single stolen password, session, or device shouldn't be usable on its own, and sensitive actions require multiple approvals. Coinbase also flagged artificial intelligence as a fast-moving security threat and pledged further investment, saying "the advancement of [AI] capabilities is rapidly changing the security landscape."

What happened at Binance

The event Coinbase is responding to is large. On Oct. 29, attackers drained Binance's hot wallets. The two secondary accounts give slightly different totals: The Block reported roughly $6.3 billion, Decrypt about $6.4 billion. Binance has said the attackers used a fake job interview and an internal AI tool to help carry out the breach, per The Block. The FBI has attributed the theft to North Korea's TraderTraitor group, according to Decrypt.

On the recovery side, Binance said Wednesday it has replenished approximately 98% of the affected assets and is acquiring the remaining 2% through market and over-the-counter channels, with those purchases slowed by lower liquidity, The Block reported. Binance also said it expanded its Proof of Reserves coverage to 44 tokens, up from 10, with a new zero-knowledge proof expected to take 50 to 60 hours to generate. CZ — Binance cofounder and former CEO Changpeng Zhao — called for AI-based defenses and an industry alliance to freeze stolen funds faster, saying, "The only way to fight a monster is to kind of become that monster," per The Block.

Independent of Binance's own account, blockchain analytics firm Elliptic found the laundering spanned about 12,000 wallets in under four days, while stablecoin issuers froze roughly 44% of the haul, according to Decrypt. The same report notes the breach landed amid a run of other incidents: Brazil's Mercado Bitcoin halted withdrawals after a $40 million hack, and French bank Crédit Mutuel Arkéa confirmed a cyberattack tied to a $133 million crypto theft.

Key facts

• Binance loss: ~$6.3 billion (The Block) to ~$6.4 billion (Decrypt), drained from hot wallets on Oct. 29.
• Attribution: FBI attributed the theft to North Korea's TraderTraitor group (Decrypt). Binance says attackers used a fake job interview and an internal AI tool (The Block).
• Binance recovery: ~98% of affected assets replenished; remaining 2% being bought via market/OTC; Proof of Reserves expanded to 44 tokens from 10; new ZK proof takes 50–60 hours (The Block).
• Laundering: ~12,000 wallets in under four days; stablecoin issuers froze ~44% of the haul (Elliptic, via Decrypt).
• Coinbase claim: more than 99% of customer assets in cold storage; split keys, withdrawal rate limits, anomaly detection, kill switches; assets held 1:1 (The Block, Decrypt).
• Coinbase balance sheet: $8.6 billion in cash and equivalents and $377 billion in assets on platform as of Sept. 30 (Decrypt).
• Other incidents (same window): Mercado Bitcoin halted withdrawals after a $40M hack; Crédit Mutuel Arkéa confirmed a $133M crypto theft (Decrypt).

The real-world read

Start with what the Coinbase post actually is: marketing. It is a company using a competitor's worst week to sell its own safety, and nearly every number in it — the 99% cold-storage figure, the "held 1:1," the layered controls — is self-reported and not independently verified here. That doesn't make it false; cold storage is a real and standard practice. But "trust our description of our own security" is exactly the posture a reader should treat with skepticism, especially when it arrives as a blog post rather than an audit.

Coinbase's own recent record cuts against the "can't happen here" framing, and notably the post doesn't foreground it. Decrypt points out that in May 2025 Coinbase disclosed criminals had bribed overseas customer-support agents to steal personal data on less than 1% of monthly transacting users, then demanded a $20 million ransom it refused to pay — an insider attack, the exact category Coinbase now says its controls defend against. And just last week, Coinbase said a breach at analytics vendor Amplitude exposed contact data for a "small subset" of customers. Funds weren't touched in either case, but both show the attack surface isn't only hot wallets, and that Coinbase has been hit through people and vendors before.

Binance's numbers deserve the same scrutiny. "Replenished approximately 98%" is Binance's own claim about Binance, with no independent confirmation cited; the only outside measurement here is Elliptic's laundering analysis and the ~44% stablecoin-freeze figure, which describe the theft, not the recovery. The mechanics also raise a question Binance doesn't address: buying back 2% of a multi-billion-dollar loss "through market and over-the-counter channels" means a large exchange making large purchases, which can move the very prices it's buying at — a cost borne somewhere, disclosed nowhere. The Proof of Reserves expansion from 10 to 44 tokens is a reactive upgrade; it's worth noting it took a $6 billion-plus breach to prompt it.

Two sources, two different headline numbers — $6.3 billion vs. $6.4 billion — and neither is primary; both trace to Binance's own disclosures about the size of its loss. Treat the figure as approximate. And CZ's "become the monster" line is a quote, not a plan: there's no detail on what an AI-based "industry alliance" would actually do, who would run it, or how it would freeze funds faster than the stablecoin issuers already did.

Opinion, and whose

• Coinbase (interested party): its controls mean a stolen password, session, or device "can't be used on its own," and it will keep investing in "best in class security" as AI changes the threat landscape. This is the company's characterization of its own defenses.
• CZ / Changpeng Zhao (Binance cofounder): crypto firms need AI-based defenses and an industry alliance to share lessons and freeze stolen funds faster — "the only way to fight a monster is to kind of become that monster."
• Elliptic (analytics firm): the stolen funds moved through ~12,000 wallets in under four days, with ~44% frozen by stablecoin issuers — an outside measurement of the theft, not of either exchange's safety.

Sources

• The Block (Tier 2, secondary), Nov. 4, 2026 — Coinbase's cold-storage and controls claims, the $6.3 billion loss figure and Oct. 29 date, Binance's 98%-replenished and Proof-of-Reserves/ZK-proof details, the fake-job-interview vector, and CZ's remarks. Reports Binance's and Coinbase's own statements; those are interested-party claims.
• Decrypt (Tier 2, secondary), Nov. 4, 2026 — the $6.4 billion figure, Coinbase's split-key/kill-switch detail and $8.6B/$377B balance-sheet figures, the May 2025 insider-bribery and Amplitude vendor incidents, FBI attribution to TraderTraitor, Elliptic's laundering data, and the Mercado Bitcoin and Crédit Mutuel Arkéa incidents.
• Primary material referenced, not independently reviewed here: Coinbase's Wednesday blog post and Binance's statements — both are the companies' own communications about themselves and read as such; Coinbase's post functions as security marketing.

This is news reporting, not financial advice; nothing here is a recommendation to buy, sell, or hold anything.