Coinbase Puts 99% of Customer Assets Offline. The Other 1% Is $3.8 Billion

Coinbase said on November 4 that more than 99% of customer assets sit in offline cold storage, days after a $6.34 billion breach at Binance. The claim is self-reported, and the fraction left online is large enough to matter.

What Coinbase Actually Disclosed

The disclosure lands days after $4 billion left Binance once withdrawals reopened. Coinbase published the figure on X alongside a blog post describing how it holds customer funds. The exchange wrote that secure custody is daily work rather than a one-time achievement, a line aimed at the Binance fallout.

Internet-connected hot wallets hold enough liquidity to process withdrawals, and excess balances are shifted into offline storage routinely. Coinbase’s institutional custody product runs entirely in cold storage, with holdings segregated onchain.

Customer deposits are backed one to one, remain customer property, and are never lent without authorization, Coinbase says. Its infrastructure and funds were untouched by the Binance incident.

What makes the disclosure notable is the timing, coming after a hack that did not touch cold storage at all.

The One Percent Nobody Prices

Coinbase reported $377 billion in total platform assets as of September 30, alongside $8.6 billion in cash and $2.2 billion in crypto held for investment. Apply the 99% figure and about $373 billion sits offline, while roughly $3.8 billion remains in systems connected to the internet.

That remainder is not trivial. It equals about 59% of the $6.34 billion stolen from Binance, and it is the part of the balance sheet exposed to the same class of attack.

Coinbase describes layered defenses. Private keys are split into components and never reconstructed in full, even during signing. Production changes require multiple employees. Anomaly detection and transfer limits can pause suspicious withdrawals, and kill switches can disable signing until investigators clear the systems.

The distinction matters. The Binance attackers did not break cold storage. They obtained valid signatures from inside the exchange’s own infrastructure, which is exactly the scenario Coinbase’s controls are designed to interrupt.

The number itself remains unverified. Coinbase’s 99% is a company statement, not a third-party attestation. Its SOC examinations cover specified operational controls, and the exchange acknowledges they do not establish that every asset is protected against theft.

Why the Binance Attack Still Matters Here

The Binance breach reset the reference point for every exchange’s security page. Roughly $6.34 billion left wallets across multiple networks, the largest exchange theft on record, and the attacker reached the signing layer rather than a vault.

Coinbase is regulated by the New York Department of Financial Services through its custody subsidiary, files audited statements with the SEC, and holds licences in multiple jurisdictions. Those facts carry weight. They do not answer the question a customer asks after a hack of this size.

The custody question has also widened beyond exchanges. Tokenized funds, stablecoin freezes and third-party custody arrangements now decide who can actually move an asset, a point that came up repeatedly in October when issuers blocked stolen balances.

Coinbase’s disclosure is a reasonable answer to a fair question. It is not proof, and the exchange does not present it as such. The next step would be an attestation that covers the cold-storage ratio specifically, published on a schedule rather than after a competitor’s crisis. Cointribune tracks Coinbase’s disclosures as they develop.