Coinbase Details How It Protects Customer Crypto Assets
Coinbase has outlined its security framework following concerns raised by Binance’s reported hot wallet incident, emphasizing that its own systems and customer funds were not affected. The exchange says it currently keeps more than 99% of customer assets in cold storage, while using multiple authorization and monitoring controls to protect the funds that move through its hot wallets.
In a security update published on November 4, 2026, Coinbase described safeguards covering private-key management, withdrawal limits, suspicious-activity detection, employee access, and emergency shutdown procedures. The company also reiterated that customer assets are held on a 1:1 basis and remain the property of customers.
The update comes as cryptocurrency platforms face an evolving security environment, including increasingly capable artificial intelligence tools that may change how attackers target digital asset infrastructure.
More Than 99% of Customer Assets Stay in Cold Storage
Coinbase separates its wallet infrastructure into hot and cold storage. Hot wallets hold a relatively small portion of assets so customers can make withdrawals and use their funds without unnecessary delays. Cold wallets keep assets offline, reducing their exposure to internet-connected systems.
The company says more than 99% of customer assets are currently held in cold storage. Hot wallet balances are monitored by personnel, services, and cryptographic systems, with funds moved between storage environments as customer deposit and withdrawal demand changes. Excess assets are regularly transferred back into cold storage.
Coinbase also says assets held through its dedicated Custody vault product are kept 100% in cold storage and are segregated onchain. This arrangement is designed to separate institutional custody assets from other wallet activity.
Distributed Keys and Withdrawal Limits Protect Transfers
Keeping assets offline is only one part of wallet security. Coinbase says it also applies multiple checks to transactions moving through both hot and cold wallets.
For cold custody, private keys are divided into separate pieces. The company says the complete private key is never reconstructed, including during transaction signing. Its hot-wallet infrastructure also restricts standing production access: no single employee has unrestricted access to the wallet-signing service, and changes to that service require involvement from multiple personnel.
The exchange also uses rate limits to control how quickly assets can move from cold wallets into hot wallets. When withdrawal activity exceeds expected levels or appears unusual for an account, wallet, asset, or network, its operations team investigates before the transaction proceeds. This approach is intended to distinguish legitimate demand, such as increased activity during volatile market conditions, from potentially suspicious transfers.
Emergency Controls Can Stop Wallet Activity
Coinbase says it maintains kill switches that can halt some or all fund movements when its systems detect a potential problem. Certain emergency stops operate at the cryptographic level by taking signing keys offline. This prevents transactions from being signed until the company deliberately restores access.
Before resuming operations, Coinbase says it reviews the affected systems to confirm that they remain intact, the cause of the issue is understood, and vault activity can safely restart.
The company also limits permanent access to production systems where possible. Employees who need elevated access receive time-limited permissions through just-in-time access controls. Changes to production code and access roles may require software-based or cryptographic consensus, along with multi-factor authentication, to prevent one person from acting independently.
Employee Access and Phishing Protections Add Another Layer
Coinbase says sensitive production roles are assigned to designated personnel who undergo enhanced background checks and additional monitoring. The company also designs its internal controls around the assumption that employees may be targeted by phishing attempts.
According to its security update, a stolen password, session, or device should not be sufficient on its own to authorize sensitive activity. Employee sign-ins use phishing-resistant authentication, while important actions require independent verification and multiple approvals. Continuous monitoring also alerts Coinbase’s global security operations center to unusual employee-account activity.
These controls are intended to reduce the risk that an attacker can gain access to internal systems and use a single compromised account or device to move customer funds.
Coinbase Reaffirms 1:1 Customer Asset Backing
Coinbase says customer assets are held on a 1:1 basis, remain customer property, and are not lent or used unless customers instruct the company to do so. It also says its records track customer holdings separately from company assets.
The exchange describes itself as a U.S.-based, publicly traded S&P 500 company with more than 80 regulatory licenses globally. Its financial statements undergo quarterly external auditor reviews, and it files annual audited financial statements with the U.S. Securities and Exchange Commission.
As of September 30, 2026, Coinbase reported $8.6 billion in cash and cash equivalents, $2.2 billion in crypto assets held for investment, and $377 billion in assets on its platform. The company’s Form 10-Q filed with the SEC on October 29, 2026 provides additional financial information for the quarter.
Regulatory Oversight and Security Leadership
Coinbase says its U.S. custodian, Coinbase Custody Trust Company, operates as a fiduciary under New York law and as a qualified custodian regulated by the New York Department of Financial Services. The regulator lists Coinbase Custody Trust Company among entities holding a limited-purpose trust charter.
In Europe, Coinbase says it is authorized under the Markets in Crypto-Assets Regulation (MiCA) and supervised by Luxembourg’s Commission de Surveillance du Secteur Financier (CSSF). The CSSF’s crypto-asset service provider framework outlines the authorization and supervisory requirements that apply to covered providers.
The company also says it was among the first crypto custodians to complete SOC 1 Type II and SOC 2 Type II examinations, which assess whether relevant controls operate effectively over time.
Coinbase’s security team is led by Chief Security Officer Jeff Lunglhofer, who previously served as Chief Information Security Officer at BNY. The team includes security engineers, cryptographers, threat intelligence analysts, and investigators with experience in financial services, national security, and law enforcement.
AI Threats Keep Security Investment in Focus
Coinbase says the rapid advancement of artificial intelligence is changing the security landscape and that it plans to continue investing in security innovation. The company presents ongoing monitoring and improvements to its safeguards as a continuing responsibility rather than a one-time security project.
Its November 4 update sets out how cold storage, distributed keys, transaction limits, employee-access controls, and emergency shutdown mechanisms work together to protect customer assets. While these measures describe Coinbase’s stated approach, no security framework can eliminate every risk. Customers should continue to consider the custody arrangements and risks associated with holding digital assets on any centralized platform.
