By Coinbase has detailed how it protects customer assets following Binance‘s $6.34 billion security breach, saying more than 99% of customer holdings remain in cold storage while Binance separately reported that it has replenished approximately 98% of the assets affected by the October 29 attack.Coinbase said on November 4 that it was not affected by the Binance incident and that customer assets remain held 1:1. The exchange said those assets remain customer property and are not lent or otherwise used unless customers authorize it.
The disclosure provides a direct comparison between Coinbase’s custody architecture and the controls that failed during the Binance breach, which Binance has attributed to a multi-stage intrusion involving a fake recruitment process, compromised employee systems and misuse of internal infrastructure.
How Does Coinbase Limit Hot-Wallet Exposure?
Coinbase said more than 99% of customer assets are currently held offline, with only a small portion maintained in hot wallets to satisfy withdrawals and other customer activity.
Hot-wallet balances are adjusted as demand changes, while excess assets are continuously moved back into cold storage. Coinbase said its dedicated custody vault assets are held entirely in cold storage and segregated on-chain.
The exchange also uses distributed key protection. In cold-storage workflows, private keys are divided into separate pieces and are not reconstructed in full during signing. Coinbase said no single employee has standing production access capable of independently moving assets from its hot-wallet infrastructure.
Other controls include withdrawal-rate limits, anomaly detection and kill switches that can halt some or all fund movements when suspicious activity is detected. Coinbase said certain shutdown mechanisms can take signing keys completely offline until the affected systems have been reviewed.
The emphasis on signing controls is particularly relevant after Binance disclosed how compromised infrastructure contributed to unauthorized wallet authorizations during its October attack.
Investor Takeaway
The percentage of assets held offline matters, but the Binance incident also shows that custody risk depends on how signing authority, employee access and emergency revocation controls are structured. Cold storage alone does not describe the full security model.
Why Is Coinbase Focusing on Employee and AI-Related Threats?
Coinbase said it assumes employees will be targeted by phishing and therefore uses phishing-resistant authentication, limited production access and multiple approvals for sensitive actions.
The exchange specifically pointed to artificial intelligence as a changing security risk, saying it plans to continue investing in defenses as AI-assisted attacks become more capable.
That warning follows Binance’s account of the October 29 breach. The exchange said attackers used a fraudulent job-interview process to compromise an employee and later accessed an internal AI-related tool as part of a longer intrusion sequence.
Binance said its security team had already blocked 57 suspected North Korea-linked cyberattacks during 2026 before the successful breach. The blocked attempts included fake recruitment campaigns and malicious software, showing that repeated defenses did not eliminate the risk of one successful compromise.
Investor Takeaway
The attack shifts attention from simple private-key theft toward operational security. Exchanges increasingly need controls designed around compromised employees, software supply chains and authenticated internal systems rather than assuming attackers will target wallets directly.
How Much of Binance’s $6.34 Billion Loss Has Been Replenished?
Binance said Wednesday that approximately 98% of the affected assets have now been replenished using its own resources. The exchange said it has reserved more than enough funds to cover the full loss and is purchasing the remaining 2% through market and over-the-counter channels.
The remaining assets are less liquid, meaning acquiring the required quantities could take longer without materially moving market prices.
The latest figure follows earlier recovery updates after on-chain data initially showed billions of dollars leaving Binance-linked hot wallets. Binance subsequently put the total impact at approximately $6.34 billion and said roughly $2.85 billion had been frozen or intercepted, subject to reconciliation and market-price changes.
What Does Binance’s Expanded Proof of Reserves Show?
Binance also completed a new Proof of Reserves snapshot on November 4 covering 44 tokens, up from 10 in its previous post-hack snapshot.
The exchange said generation of the full zero-knowledge proof will require approximately 50 to 60 hours. Once completed, customers holding covered assets will be able to verify that their account balances are backed by reserves of at least 1:1.
The expanded snapshot increases the number of assets customers can independently check, but Proof of Reserves addresses a different question from cybersecurity. It can provide evidence that corresponding assets exist at a specific point in time; it does not prove that the systems controlling those assets cannot later be compromised.
Investor Takeaway
The post-hack comparison between Coinbase and Binance is increasingly about architecture as well as solvency. Binance is demonstrating that it can replace affected assets, while Coinbase is emphasizing controls intended to reduce the probability and scale of an unauthorized transfer in the first place.