Coinbase Lays Out Hot Wallet Controls as Customers Ask if a Binance-Style Hack Could Hit It

Coinbase said it was untouched by the theft from Binance’s hot wallets and that it holds more than 99% of customer assets in cold storage, in a blog post published Nov. 4 that walks through how it protects customer funds.

Coinbase said customers had been asking whether a similar breach could happen on its platform. “Coinbase was not impacted and our systems and customer funds remain unaffected,” the company wrote.

Binance has put its losses from the Oct. 29 attack at about $6.3 billion, and blockchain analytics firm TRM Labs attributed the theft to North Korea’s TraderTraitor group. Asked whether Binance should have kept that much in hot wallets, Pablo Sabbatella, founder of Opsek, said on Unchained that “I don’t think it would be unrealistic they could have a bank run of more than $6 billion,” which an exchange would have to meet by “topping up hot wallets from cold wallets.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

Coinbase said its hot wallets carry only a small share of assets, sized to customer deposit and withdrawal demand, and that it keeps sweeping any excess back to cold storage. Assets in its Custody vault product, it said, are fully offline.

The company named three main safeguards. First, distributed keys: cold wallet keys are split into pieces that are never put back together, even to sign, while on the hot side, the company said, “no single individual has standing production access to our wallet signing service” and any production change needs several people. As a result, Coinbase wrote, “stealing a laptop, breaking into a server, or one bad actor inside the company cannot sign or reconstruct a wallet private key.”

Second, rate limits: Coinbase caps how quickly funds can move from cold wallets into hot ones, and its wallet operations team reviews flagged withdrawal activity before it goes through. Third, kill switches: the exchange said it can stop some or all fund movements, in some cases by taking signing keys offline until a review clears them.

Coinbase said every customer asset is held 1:1 and still belongs to that customer, and that it tracks those holdings apart from its own, adding that “Coinbase does not lend or use those assets unless customers instruct us to.”

The company reported $8.6 billion in cash and cash equivalents and $2.2 billion in crypto held for investment as of Sept. 30, figures that match its quarterly 10-Q filing. The post also cited $377 billion in assets on its platform.

Coinbase said its security team is run by Chief Security Officer Jeff Lunglhofer, who was previously chief information security officer at BNY. The company said advances in artificial intelligence are rapidly reshaping security threats and that it will keep investing in its defenses.

Related Listen: Binance Lost $6.3 Billion in 20 Minutes. Can Crypto Stop the Next One?

The post Coinbase Lays Out Hot Wallet Controls as Customers Ask if a Binance-Style Hack Could Hit It appeared first on Unchained.