Coinbase’s Nov. 4 message was reassurance, not a guarantee: the company said it was unaffected by Binance’s Oct. 29 security breach and that its systems and customer funds remained safe. Coinbase also reported that more than 99% of customer assets were held in cold storage. That percentage should be understood as Coinbase’s claim; the supplied reporting does not independently verify the exact figure or test the controls behind it.
18
19
20
What Coinbase said about protecting customer assets
Coinbase described a layered custody setup. It reported keeping most customer assets offline, with a smaller share in internet-connected hot wallets for customer activity. Reports also describe distributed private keys, withdrawal limits and anomaly monitoring; Coinbase said it can halt signing in an emergency.
20
22
24
Coinbase also said customer assets are backed 1:1, remain customer property and are not lent or used without customer authorization. Those statements address custody and ownership, but they do not by themselves prove that every step in the transfer-approval process is secure.
26
32
These safeguards are relevant, but the evidence available here is primarily company statements and reporting about those statements. It does not independently establish that the controls would prevent every comparable attack.
What happened at Binance
Binance’s Nov. 3 incident update put the affected assets at approximately $6.34 billion and the amount frozen or intercepted at about $2.85 billion, subject to reconciliation and market-price changes.
50 On Nov. 4, reporting said Binance had replenished approximately 98% of the affected assets. Replacing assets is not the same as recovering them from the attackers.
20
Reporting on the attack described a chain that included fake recruitment interviews, malware, a compromised employee laptop and an internal AI tool. Later accounts also described attackers abusing transaction-authorization mechanisms.
7
47 Binance’s initial update said it had found no evidence that wallet private keys had been leaked.
40 The FBI attributed the theft to North Korea’s TraderTraitor group.
1
The distinction matters: an exchange can protect private keys yet still face risk if an attacker gains access to systems or processes that authorize transactions. Reporting said the Binance incident affected corporate holdings rather than customers’ individual accounts. Customers nevertheless withdrew $3.6 billion after the exchange reopened, according to the BBC.
12
2
Why cold storage alone is not the whole answer
Cold storage reduces the amount of customer crypto that is directly reachable through internet-connected systems. But a high offline-storage share is only one layer of security. Exchanges also have to protect signing services, access to internal systems and the approval rules that govern transfers. The Binance incident—where initial findings reported no evidence of stolen wallet keys, while later accounts described abuse of transaction authorization—illustrates that distinction.
40
47
The practical takeaway is narrower than “Coinbase is immune.” Coinbase said it was unaffected and described safeguards for custody and withdrawals. Its more-than-99% figure is a useful description of its reported storage approach, but it is not independent proof that the full authorization chain is invulnerable.
19
20
24