Coinbase: 99% in cold storage after Binance’s $6.3B breach

Coinbase said on Wednesday that more than 99% of customer assets sit in cold storage after Binance suffered a $6.3 billion exploit on Oct. 29, adding that the breach did not affect its platform or customer funds.

Binance, described as the world’s largest crypto exchange, said on Tuesday that attackers used a fake job interview and an internal artificial intelligence tool to assist the breach.

In a Wednesday blog post, Coinbase said customer assets are held on a 1:1 basis, remain customer property and are not lent or otherwise used without customer authorization. It also cited distributed private keys, withdrawal limits and anomaly detection as controls against unauthorized transfers.

The disclosures show different operating positions: Coinbase says the incident did not affect it, while Binance is still replacing the assets affected by the breach.

What does the breach change for customers?

For customers, the immediate distinction is custody design, not proof that one exchange’s controls eliminate risk. Coinbase places more than 99% of customer assets in cold storage, splits private-key control across distributed keys and applies withdrawal limits and anomaly monitoring.

For industry operators, the breach method broadens the security perimeter beyond private-key storage: attackers used a fake job interview and an internal AI tool, while Coinbase’s response emphasizes monitoring and security investment.

Coinbase wrote: “Our responsibility is to keep improving safeguards and continuously monitor for threats so Coinbase can be the best place for customers to grow, use and move their money.”

The company added: “The advancement of artificial intelligence capabilities is rapidly changing the security landscape, and, in response, Coinbase will continue to invest in best in class security innovation.”

The statements make AI-assisted security investment an operating priority, complementing the key-management, withdrawal and monitoring controls Coinbase already listed.

On Tuesday, Binance cofounder and former CEO Changpeng “CZ” Zhao said crypto companies need AI-based defenses and an industry alliance to share lessons and freeze stolen funds faster. “The only way to fight a monster is to kind of become that monster,” Zhao said.

That framing makes information sharing an enforcement tool, with the stated objective of freezing stolen funds sooner rather than relying on each exchange to respond alone.

Binance also provided a recovery update on Wednesday. The exchange said it has replenished approximately 98% of the assets affected by its security breach and expanded its Proof of Reserves coverage to 44 tokens from 10 previously.

• Binance is acquiring the remaining 2% through market and over-the-counter channels. Lower liquidity means those purchases take longer.
• Binance expects the new zero-knowledge proof to take 50 to 60 hours to generate, or roughly two to two-and-a-half days.

Extending coverage from 10 to 44 tokens broadens the asset set covered by Binance’s reserve reporting. The 98% replenishment figure does not yet represent completion because the remaining 2% is still being acquired.

For market participants, the next concrete checkpoint is Binance’s zero-knowledge proof, whose generation the exchange expects to take 50 to 60 hours, while lower liquidity continues to govern how quickly it acquires the remaining 2%.