Coinbase indicates that the $6.34 billion hot wallet hacking incident at Binance did not affect its systems or customers' funds, and it is claimed that over 99% of customers' assets are stored in cold storage.
- According to Coinbase, their system and customer funds were not affected by the Binance Hot Wallet incident.
- According to TechFlow, over 99% of customer assets are stored in cold storage.
- The exchange stated that customer assets are always fully supported and must not be utilized without permission.
- South Korean authorities have requested local exchanges to strengthen cold storage and withdrawal controls.
According to a quote from a blog post by TechFlow on November 4th regarding Coinbase, this American exchange keeps over 99% of its customers' assets in cold wallets and will adjust the balances in hot wallets to meet withdrawal and deposit needs.
The protective measures listed in this statement include distributed signature keys, withdrawal limits, detection of abnormal activities, and control mechanisms that can prevent transaction signatures.
This statement by Coinbase came shortly after the CoinEx theft incident on October 29th. At that time, the attackers accessed an internal wallet signing service and transferred assets outside of the normal withdrawal process of the exchange.
Coinbase explains how it holds customer assets
In its public hosting instructions, Coinbase states that customers still retain ownership of the digital assets held through their exchange. Internal records track account activities, while the company holds the customer assets in a 1:1 ratio.
The exchange stated that unless explicitly instructed by the customer, these assets will not be lent out or used in any other manner.
Its storage arrangement combines offline facilities with secure multi-party computing ( MPC ). MPC distributes the encrypted signature materials to different participants.
According to the company, each participant only holds their own share, and transactions can be signed without having to centralize all the keys in one place. Each participant will verify the transaction according to the applicable policies.
The above instructions apply to accounts hosted on Coinbase.com. Users who use their own self-hosted wallets are responsible for the security of their private keys.
On another page with safety instructions, Coinbase lists account protection measures, including support for dual-factor authentication with secure keys, as well as a withdrawal mechanism that requires multiple approvals through Coinbase Vault.
Different insurance protections for US crypto assets
The insurance overview for Coinbase indicates that its crime insurance provides coverage for theft of certain digital assets stored in the system, including losses caused by cybersecurity vulnerabilities.
However, this coverage does not include losses incurred as a result of others gaining access to an individual's account using stolen or leaked credentials. The company states that in the event of a covered security incident, the losses may exceed the amount that can be recovered through insurance.
For U.S. customers, the holding of cryptocurrencies is not protected by the Federal Deposit Insurance Corporation ( FDIC ) or the Securities Investor Protection Corporation ( SIPC ).
The balance in US dollars is arranged separately. Coinbase indicates that customers' US dollars can be placed in custodial accounts with financial institutions, short-term US Treasury bonds, or money market funds denominated in US dollars, depending on the applicable rules.
If US dollars are held in cash at eligible banks or credit cooperatives, in the event that such institutions fail, cross-bank deposit insurance may apply. The coverage depends on relevant conditions, records, and regulatory determinations, with a current limit of $250,000 per depositor.
Binance claims that the attackers bypassed the normal withdrawal process
In the results of the incident investigation on November 3, Binance estimated that the affected assets amounted to approximately $6.34 billion, and stated that about $2.85 billion had been frozen or intercepted. However, this figure still needs to be verified in conjunction with liquidation and market prices.
The exchange described an incident involving fake recruitment interviews, compromised developer software, and internal AI tools, after which the attackers gained access to wallet signature operations.
Binance stated that malicious Ethereum authorizations allowed further transfers to occur independently without relying on its normal withdrawal infrastructure. Suspending withdrawals and closing the hot wallet service does not automatically cancel the authorizations that have already been established on the chain.
The company stated that it has rebuilt the affected wallet systems, replaced the devices, disabled the compromised credentials, and strengthened monitoring.
According to previous reports by crypto.news, on November 2, Binance completed the reserve verification for 10 cryptocurrencies based on the snapshot from October 31. The assets covered include Bitcoin, Ethereum, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC.
South Korea requires exchanges to strengthen wallet control
After the Binance incident, the Financial Services Commission of South Korea has required domestic exchanges to strengthen the protection of cold wallets and financial reserves.
Regulatory authorities' reviews cover withdrawal approvals, administrator permissions, internal access, and transaction monitoring. Current regulations require service providers to store at least 80% of customers' encrypted assets in cold storage.
Data submitted by the Financial Supervisory Service to Member Min Byeong-deok ( Min Byeong - deok ) shows that as of the end of September, the cold storage ratio for Upbit was 99.17%, for Bithumb it was 94.76%, and for Coinone it was 85%.
Authorities also require continuous monitoring of deposit and withdrawal activities, an increase in personnel for incident response, and the establishment of a procedure for sharing information on attempted abnormal accesses.
