Coinbase said it keeps more than 99% of customer assets in cold storage, outlining its custody controls days after Binance disclosed a $6.3 billion exploit that it said began with a fake job interview and involved the misuse of an internal artificial intelligence tool.
In a Wednesday blog post, Coinbase said its platform was not affected by the Binance incident. The U.S. exchange said its safeguards include geographically distributed private-key management, withdrawal limits and anomaly-detection systems intended to identify suspicious activity before unauthorized transfers can be completed.
Coinbase also said customer assets are held on a one-to-one basis, remain the property of customers, and are not lent or otherwise used without their authorization. The statement puts renewed attention on the operational differences between exchange custody systems, particularly the amount of assets held offline versus those kept accessible for routine withdrawals and trading.
Cold storage takes focus after Binance breach
Cold storage refers to wallets whose signing keys are kept offline, reducing their exposure to internet-based attacks. It can limit the damage from a compromised online system, though exchanges must also maintain enough readily available liquidity to process customer withdrawals and support normal operations.
Coinbase said its cold-storage approach combines distributed private keys with internal controls over how withdrawals are approved. Distributed key systems divide the authority needed to move funds across multiple components or parties, making a single compromised credential less likely to be enough to authorize a transaction.
The exchange did not link its security architecture directly to the Binance attack, but its disclosure arrived as Binance has begun providing more detail about one of the largest reported thefts in the cryptocurrency sector.
Binance said the Oct. 29 exploit resulted in the loss of $6.3 billion across 10 blockchains. According to the company, the attackers penetrated its systems through a fake job interview and then used an internal AI tool during the intrusion. Binance said the theft unfolded in roughly 20 minutes after the attackers overcame its checks.
The incident illustrates that offline asset storage addresses only one part of exchange security. Social engineering, where attackers manipulate employees or contractors into granting access, can provide an entry point before a thief ever reaches a wallet-management system. Once inside, attackers may seek credentials, operational access, internal tooling or approval pathways that enable large transfers.
Binance says it has replenished 98% of affected assets
Binance said Wednesday that it had replenished about 98% of the assets affected by the breach. The exchange said it was acquiring the remaining 2% through market purchases and over-the-counter channels, with lower liquidity slowing the process.
Richard Teng, Binance's chief executive officer, said the company would use half of its emergency fund to cover losses from the incident, according to the supplied account. Binance also said outside security teams and network hosts helped freeze about $3 billion of the stolen funds.
Freezing stolen cryptocurrency depends heavily on where the assets move after an exploit. While transactions on public blockchains can be tracked, the ability to stop funds varies by token, network and intermediary. Centralized issuers can sometimes blacklist addresses or freeze tokens, while exchanges and other platforms may block deposits linked to identified thefts. Assets moved through decentralized systems or across multiple chains can be harder to contain.
The supplied account said the attackers withdrew more than 233 million XRP tokens in four minutes. Such rapid movements show why exchanges place substantial weight on automated monitoring and withdrawal controls: human intervention can be too slow once a major transfer sequence begins.
Binance has expanded the scope of its proof of reserves program to 44 tokens from 10, the company said. Proof of reserves is a process designed to show that an exchange controls specified on-chain assets, commonly through cryptographic methods and wallet disclosures. It can offer users more visibility into stated holdings, although it does not by itself provide a complete assessment of an exchange's liabilities, internal security processes or operational resilience.
Binance said its new zero-knowledge proof system is expected to take 50 to 60 hours to generate. Zero-knowledge proofs allow a party to demonstrate that a statement is true without revealing all underlying data. In an exchange-reserve setting, the technique can potentially help demonstrate that customer balances are included in a calculation without publishing every account balance.
Calls for joint response to major thefts
Changpeng Zhao, Binance's co-founder and former chief executive officer, called for more AI-based defenses and an industry group that could share attack lessons and coordinate efforts to freeze stolen funds more quickly.
That proposal reflects a practical difficulty exposed by cross-chain thefts. A major exploit can involve numerous assets, bridges, wallets and trading venues in minutes. Security firms, token issuers, blockchain infrastructure providers and exchanges may each possess part of the information needed to trace or block funds. Faster coordination can improve the odds of containment, but it also depends on accurate identification of attacker-controlled addresses and the willingness of separate entities to act.
The Coinbase statement offers a contrasting picture of how a major exchange is seeking to frame customer protection after the Binance breach: less emphasis on immediate liquidity and more on minimizing the amount of value exposed to online systems. Its claim that more than 99% of customer assets are held in cold storage suggests that only a small portion is maintained in online wallets for operating needs.
For customers, the episode also renews attention on the distinction between an exchange's custody practices and personal account security. Exchange-level protections can include cold wallets, key distribution and transaction monitoring, while individual accounts remain exposed to phishing, compromised passwords and fraudulent support contacts. Hardware security keys can add a physical verification step that makes stolen passwords alone less useful to attackers.
Binance's reported replenishment effort may reduce immediate concerns for customers affected by the breach, but the incident has placed pressure on large platforms to show both that customer assets are available and that their systems can prevent a similar intrusion from reaching withdrawal infrastructure.
Worried about exchange hacks? Learn key crypto safety standards every trader should know to better protect your assets.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
