Author|Coinbase

Compiled by| Wu Says Blockchain

The content of this article does not constitute any investment or financial advice. Readers should strictly comply with local laws and regulations.

TL;DR:

Coinbase stated that it has not been affected by the recent reports of the Binance hot wallet security incident. Currently, over 99% of customer assets are stored in cold wallets, and hot wallet funds are allocated according to customer deposit and withdrawal needs. Asset transfers are protected by multiple layers, including distributed key protection, withdrawal limits, anomaly detection, and an emergency switch that can immediately halt signatures. We hold customer assets on a 1:1 basis, and the ownership of the assets belongs to the customers. We only lend or use these assets at the explicit instruction of the customers. The rapid development of artificial intelligence is changing the security landscape, and Coinbase will continue to invest in the research and development of advanced security technologies.

Below is the full text of the article published by Coinbase:

The recent reports of the Binance hot wallet security incident have caused some customers to start worrying about one question: How does Coinbase protect customer assets and prevent similar incidents? This incident did not affect Coinbase's systems or customer funds. This article will explain how Coinbase's institution-level multi-layer protection system works, and how we protect the assets of different types of customers across products through this system.

Coinbase uses both hot wallets and cold wallets for storage. Hot wallets only hold a small amount of assets to allow customers to withdraw at any time or use them outside the Coinbase platform. Currently, over 99% of customer assets are stored in cold wallets. We proactively allocate and closely monitor hot wallet balances through operational staff, software services, and cryptographic systems to meet the constantly changing funding needs of customers in a timely manner, while continuously transferring excess funds to cold wallets. Our dedicated Custody vault product employs the same security framework as institutional custody services, with all assets stored in cold wallets and isolated on-chain.

Safeguarding wallets is just one part of the custody work; every wallet transaction also requires security verification. Coinbase has set up multiple layers of control measures for both hot and cold wallets to verify whether fund transfers conform to their intended purposes. Specific measures include:

· Distributed Key Protection: In the cold wallet custody process, all private keys corresponding to customer assets are split into multiple shards. Even during the signing process, the complete private key is not reconstructed. For hot wallets, no individual has persistent access rights to the wallet signing service production environment, and any changes to that service require the participation of multiple personnel. Both hot and cold wallets employ security designs that avoid single points of failure. Even if an attacker steals a laptop, compromises a server, or if an insider acts maliciously, they cannot complete signatures or reconstruct wallet private keys based solely on that.

· Transfer Rate Limiting and Anomaly Detection: To meet customer trading demands, we replenish funds from cold wallets to hot wallets while strictly limiting transfer speeds. When withdrawal volumes trigger alerts or there are anomalies with any account, wallet, asset, or network, the wallet operations team investigates suspicious activities, and relevant transactions must be verified before they can proceed. A surge in transfer volumes may result from active market trading on that day or it could be an anomaly signal. The limit mechanism will prevent abnormal amounts of funds from moving from cold wallets to hot wallets until staff confirms that the activity is normal.

· Emergency Stop Mechanism: Upon discovering anomalies, we can immediately suspend part or all of the fund transfers. Some emergency switches can block signatures from a cryptographic level. We will completely take down the signing keys, and before actively restoring access, no system can use these keys for signing, even if the system has been compromised. We will only restore key access once we confirm that the affected system is intact, the cause of the problem has been identified, and the vault can be safely restored to operation.

We also implement the following measures throughout the technical environment to reduce the risk of a single malicious actor executing sensitive operations alone:

· Limit Persistent Access Rights: Whenever possible, we will revoke persistent access rights to production services. Staff will only be granted temporary access through secure instant authorization mechanisms when they need to access production services, and access duration will be restricted.

· Enforce Multi-Party Confirmation: Actions like deploying code changes to the production environment or granting new role permissions need to go through multi-party confirmations via software or cryptographic mechanisms, combined with multi-factor authentication to ensure that no single user can execute them alone.

· Implement Special Management for High-Privilege Positions: We classify positions that can access fund transfer functions in the production environment as highly sensitive. Relevant personnel must undergo stricter background checks, and their operations are subject to closer monitoring.

· Reduce the Impact of Phishing Attacks: When designing protective measures, we assume that employees will become targets of phishing attacks. In addition to conducting anti-phishing training, we also implement technical measures to ensure that attackers cannot perform operations solely based on stolen passwords, login sessions, or devices. A phishing-resistant authentication method must be used when logging in, and sensitive operations require independent verification and multi-party approval. The monitoring system continuously tracks employee accounts, and any abnormal activity triggers alerts to the global security operations center.

Coinbase holds customer assets on a 1:1 basis, and ownership of the assets always belongs to the customers. Coinbase only lends or uses these assets at the explicit instruction of the customers. We separately record customer assets and the company’s own assets on the books.

Coinbase is a publicly traded company headquartered in the United States and is a constituent of the S&P 500 index. Our financial statements are reviewed by external auditors every quarter. We also submit audited annual financial statements to the U.S. Securities and Exchange Commission (SEC). Coinbase is regulated in multiple jurisdictions worldwide and holds over 80 licenses. As of September 30, 2026, we hold $8.6 billion in cash and cash equivalents, as well as $2.2 billion in investment-grade crypto assets, with a total platform asset amount of $377 billion.

Coinbase must adhere to standards equivalent to those of large financial institutions globally. Our U.S. custody entity, Coinbase Custody Trust Company, is obligated to fiduciary duties under New York state law and is a qualified custodian regulated by the New York State Department of Financial Services (NYDFS). The NYDFS is also responsible for regulating banks in New York State. In Europe, Coinbase has obtained authorization under the Markets in Crypto-Assets Regulation (MiCA) framework and is regulated by the Luxembourg Financial Sector Supervisory Commission (CSSF), enabling it to provide services to customers across the EU under a unified regulatory framework. We are also one of the first crypto asset custodians to complete SOC 1 Type II and SOC 2 Type II attestations. These attestations verify whether control measures are effectively operating in practice.

Our Chief Security Officer, Jeff Lunglhofer, previously served as Chief Information Security Officer at Bank of New York Mellon (BNY). The team he leads includes security engineers, cryptography experts, threat intelligence analysts, and investigators. Team members have work experience in financial services, national security, and law enforcement, dedicated to protecting customer assets and the systems that safeguard these assets.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。