• Coinbase held $377 billion in customer assets on platform at the end of September.

• Over 99% of Coinbase customer crypto sits in offline cold storage, the exchange says.

• Binance lost $6.3 billion on October 29 through fooled withdrawal approvals, not stolen keys.

Coinbase's $377 Billion Custody Stack

Coinbase published a full account of its custody defenses on Wednesday, confirming that more than 99% of the customer crypto on its platform is held in offline cold storage, beyond the reach of internet attackers. The disclosure arrives days after a $6.3 billion theft at rival Binance pushed exchange security back to the center of market attention, and Coinbase frames the move as its direct answer to that breach.

The company's latest quarterly filing places $377 billion in assets on the platform as of the end of September, and the exchange states in its official security post that this money belongs to customers, not the company. “Coinbase does not lend or use those assets unless customers instruct us to,” the post says. Its books keep the $377 billion separate from the firm's own $8.6 billion in cash and $2.2 billion in crypto. Coinbase, listed in the S&P 500 and trading as Nasdaq: COIN, also points to its regulatory footing: the US custody arm operates as a qualified custodian and fiduciary under New York's banking regulator, while Luxembourg's financial watchdog supervises the company in Europe under the EU's Markets in Crypto-Assets framework. External checks feature as well: the exchange says it was among the first crypto custodians to pass SOC 1 and SOC 2 Type II examinations, audits that test whether security controls actually work, under security chief Jeff Lunglhofer, who previously ran information security at BNY. Coinbase's official account confirmed the posture in a Wednesday post, calling secure custody daily work and citing 1:1 backing, key splits and no single points of failure. The record is not spotless: in 2025, criminals bribed overseas support agents for customer data, an incident the company estimated could cost up to $400 million. Research cited alongside the post also puts an estimated 84% of US spot Bitcoin ETF assets in Coinbase custody.

How the Binance Attackers Worked

Binance's own account of the breach explains why Coinbase chose this moment. The exchange says the $6.3 billion attack began with a fake job interview: intruders reached staff laptops and pushed fraudulent withdrawal requests through the system on October 29. Private keys were never touched; the approval machinery that signs withdrawals was fooled instead. The same pattern ran through the Bybit and Bitget thefts reported on November 1, with attackers in each case tricking the exchange's approval system into signing transfers rather than stealing a key.

Coinbase's architecture is built against that exact vector. It splits every private key into pieces stored on separate machines, a method known as multi-party computation, and develops its security software in-house, while the Bybit and Bitget breaches entered through outside vendors. On-chain researchers argue a stolen Coinbase laptop would expose a single useless key fragment, and that the exchange avoids the honeypot problem by spreading holdings across 69.8 million separate addresses instead of pooling them in a few live hot wallets. Regulators are moving too. South Korea's Financial Services Commission urged domestic exchanges on Monday to hold more than the legal 80% minimum offline and is weighing a rise to roughly 99%, according to News1, while Herald Business reported that Upbit already stores 99.17%. Offline custody carries a cost, though: some Bithumb withdrawals were stuck for more than 13 hours in August when its online wallet ran dry, and Korean exchanges warn that heavier security staffing will squeeze smaller platforms hardest.

The Trade-Off Behind 99% Offline

The past week has turned custody architecture into a competitive battleground, and Coinbase's disclosure is timed for it. The mechanism gap is the substance: the $6.3 billion loss came from social-engineered approvals rather than key theft, so an exchange that splits keys, writes its own software and keeps nearly everything offline faces a different attack surface than rivals that pool funds online and lean on vendors. Korea's proposed 99% floor would codify that posture into law, but Bithumb's 13-hour withdrawal freeze in August shows the liquidity price of fully offline reserves. If the rule lands, compliance costs point toward consolidation among the largest Korean venues. Retail users can copy the offline posture directly: how hardware wallets work is covered in our beginner guide, and devices such as the Tangem Mobile Wallet apply the same key-isolation principle in a pocket-sized form.