How Does Coinbase Limit Hot-Wallet Exposure?
Coinbase said more than 99% of customer assets are currently held offline, with only a small portion maintained in hot wallets to satisfy withdrawals and other customer activity.Hot-wallet balances are adjusted as demand changes, while excess assets are continuously moved back into cold storage. Coinbase said its dedicated custody vault assets are held entirely in cold storage and segregated on-chain.The exchange also uses distributed key protection. In cold-storage workflows, private keys are divided into separate pieces and are not reconstructed in full during signing. Coinbase said no single employee has standing production access capable of independently moving assets from its hot-wallet infrastructure.Other controls include withdrawal-rate limits, anomaly detection and kill switches that can halt some or all fund movements when suspicious activity is detected. Coinbase said certain shutdown mechanisms can take signing keys completely offline until the affected systems have been reviewed.The emphasis on signing controls is particularly relevant after Binance disclosed how compromised infrastructure contributed to unauthorized wallet authorizations during its October attack.
Investor Takeaway
Why Is Coinbase Focusing on Employee and AI-Related Threats?
Coinbase said it assumes employees will be targeted by phishing and therefore uses phishing-resistant authentication, limited production access and multiple approvals for sensitive actions.The exchange specifically pointed to artificial intelligence as a changing security risk, saying it plans to continue investing in defenses as AI-assisted attacks become more capable.That warning follows Binance’s account of the October 29 breach. The exchange said attackers used a fraudulent job-interview process to compromise an employee and later accessed an internal AI-related tool as part of a longer intrusion sequence.Binance said its security team had already blocked 57 suspected North Korea-linked cyberattacks during 2026 before the successful breach. The blocked attempts included fake recruitment campaigns and malicious software, showing that repeated defenses did not eliminate the risk of one successful compromise.
Investor Takeaway
How Much of Binance’s $6.34 Billion Loss Has Been Replenished?
Binance said Wednesday that approximately 98% of the affected assets have now been replenished using its own resources. The exchange said it has reserved more than enough funds to cover the full loss and is purchasing the remaining 2% through market and over-the-counter channels.The remaining assets are less liquid, meaning acquiring the required quantities could take longer without materially moving market prices.The latest figure follows earlier recovery updates after on-chain data initially showed billions of dollars leaving Binance-linked hot wallets. Binance subsequently put the total impact at approximately $6.34 billion and said roughly $2.85 billion had been frozen or intercepted, subject to reconciliation and market-price changes.
What Does Binance’s Expanded Proof of Reserves Show?
Binance also completed a new Proof of Reserves snapshot on November 4 covering 44 tokens, up from 10 in its previous post-hack snapshot.The exchange said generation of the full zero-knowledge proof will require approximately 50 to 60 hours. Once completed, customers holding covered assets will be able to verify that their account balances are backed by reserves of at least 1:1.The expanded snapshot increases the number of assets customers can independently check, but Proof of Reserves addresses a different question from cybersecurity. It can provide evidence that corresponding assets exist at a specific point in time; it does not prove that the systems controlling those assets cannot later be compromised.