With the increasing capabilities of AI, zero-day vulnerabilities are becoming more prevalent, exposing crypto assets to significant risks. One attack involved breaching the operations and maintenance computer and then exploiting the delegation mechanism of EIP-7702 to transfer funds from hot wallets. This incident made me re-examine the security design of exchanges. Hot wallets will inevitably be targeted. The real questions are twofold: how much money is held in the hot wallet – this is the largest risk exposure – and whether an attacker, after gaining access to a terminal, can proceed to large-scale withdrawals. Coinbase (@coinbase) has held a maximum of $377 billion in custody. I reviewed their official materials regarding their security measures: The first layer is the asset structure. Over 99% of customer assets are held in offline cold wallets. Hot wallets only hold the amount needed for daily withdrawals, with any excess continuously transferred back to cold wallets. Customer assets are held in custody at a 1:1 ratio, recorded separately from company assets, and will not be lent out or misappropriated without customer authorization. The second layer is the protection of the cold wallet itself. Private keys are split and stored across multiple secure systems, and a complete private key is not reconstructed during signing. Transfers from cold wallets to hot wallets are subject to limits and anomaly detection. Suspicious transfers are blocked first, investigated, and then processed. An emergency stop can be initiated if necessary, suspending some or all fund flows and taking the signing key offline. The third layer involves offensive and defensive investments. Bug bounties primarily reward high-risk vulnerabilities; continuous adversarial testing using AI agents covers code, applications, and infrastructure; AI audits smart contracts; and collaborations with Anthropic and OpenAI provide early access to new models and permission to implement security defenses. For users, there are official verification prompts when receiving calls, anti-fraud tests before large transfers, and risk warnings for receiving addresses. Regarding transparency, Coinbase is a Nasdaq-listed company, with its financial reports reviewed quarterly by Deloitte and a full audit conducted at the end of the year. As of September 30, 2026, the company had $8.6 billion in cash and cash equivalents, and approximately $377 billion in assets were held in custody for users on the platform. In numerous hot wallet incidents, Coinbase's system and customer funds remained unaffected, so the general probably won't dare to target the United States for the time being.