After the $6.3 Billion Binance Hack, Exchanges Are Showing Their Vaults: Coinbase Says 99% in Cold Storage as Binance Replenishes 98%

One week after the largest hack in crypto history, the industry's biggest exchanges are answering the same question in public: where exactly is your customers' money, and how safe is it? On Wednesday, November 4, Coinbase published a security update saying that more than 99% of customer assets sit in cold storage — offline wallets disconnected from the internet — and that it was not affected by the Binance breach. The same day, Binance said it has replenished approximately 98% of the assets affected by its October 29 security breach, and expanded its proof-of-reserves coverage from 10 tokens to 44 tokens. Two very different announcements, one shared message: after $6.3 billion disappeared from the world's largest exchange in a single intrusion, "trust us" is no longer enough — exchanges are now competing on verifiable custody. Coinbase's disclosure is worth reading in detail, because cold storage is the single most important security fact about any exchange, and it is often misunderstood. Cold storage means the private keys that control customer funds are kept on devices that are never connected to the internet, so a hacker who compromises a company's servers, laptops or cloud systems still cannot reach the bulk of the money. Coinbase says it combines that with distributed private keys — no single key or person can move funds alone — plus withdrawal limits and anomaly detection that flag unusual outflows before they complete. It also restated the custody basics that matter most to users: customer assets are held 1:1, remain customer property, and are not lent or used without customer authorisation. That last point is the one that failed at several collapsed exchanges in past cycles, where customer funds were quietly put to other uses. A 1:1, un-lent, cold-stored balance sheet is the standard every exchange should now be judged against. What Binance's 98% replenishment actually means. Binance's update answers a different question: what happens after the money is already gone? The October 29 intrusion, which Binance has said began months earlier with a compromised developer laptop and a fake job interview, drained about $6.3 billion from hot wallets. Binance has pledged to cover customer losses, and its November 4 statement — that approximately 98% of affected assets have been replenished — is the first quantified progress report on that pledge. Replenishment is not the same as recovery: much of the stolen crypto was frozen by stablecoin issuers or blocked by other exchanges, but the gap between what was taken and what has been frozen is being filled from Binance's own resources. For users, the practical test is simpler than any percentage: withdrawals have been working normally, and the exchange's own proof-of-reserves reporting now covers far more assets than before. That expansion — from 10 tokens to 44 — matters because proof of reserves is only useful if it covers what users actually hold. A report covering only Bitcoin and a handful of large tokens can look clean while smaller holdings go unverified. Forty-four tokens is a much harder test to pass, and it raises the bar for every other exchange that still publishes a narrow report. It does not, on its own, prove solvency — proof of reserves shows assets, not liabilities, and independent auditors have long warned that a reserves snapshot without a matching liabilities check is incomplete. But combined with working withdrawals and a replenishment figure, it is a materially stronger position than the industry was in a week ago. See also Binance's earlier zero-knowledge proof of reserves update, and our coverage of Binance's cyber-insurance position after the hack. Why this week made custody the story: the $133 million Arkéa theft. The urgency behind both announcements is visible in a second, quieter incident from the same week. Blockchain investigator ZachXBT identified French banking group Crédit Mutuel Arkéa as the suspected victim of a cryptocurrency theft exceeding $133 million, after tracing suspicious withdrawals from exchange accounts. Blockchain analytics firm Bitquery traced approximately $108.8 million in USDC withdrawn from accounts at Kraken, Crypto.com and OKX over about 21 hours on November 1 and 2. Crypto.com confirmed it intervened to block funds linked to the incident and said all user funds remain secure; Arkéa confirmed to CoinDesk that an attack had enabled fraudulent transactions but was now under control. Investigators have not yet determined how the attacker accessed the exchange accounts — which is precisely the point. When the victim is a bank holding crypto through exchange accounts, the security of those accounts is the security of the institution. Key figures: Coinbase — more than 99% of customer assets in cold storage; distributed keys, withdrawal limits, anomaly detection; assets held 1:1, customer property, not lent without authorisation; not affected by the Binance breach. Binance — approximately 98% of affected assets replenished after the $6.3 billion October 29 breach; proof-of-reserves coverage expanded from 10 to 44 tokens. Arkéa case — over $133 million suspected theft; about $108.8 million in USDC traced from Kraken, Crypto.com and OKX accounts over about 21 hours; Crypto.com blocked linked funds; Arkéa says the attack is now under control. The lesson: cold storage, 1:1 custody and broad proof of reserves are now the minimum credible standard — ask any exchange you use to show all three. For ordinary users, the checklist that follows from this week is short and practical. Ask where your exchange keeps the bulk of customer funds, and whether that figure is published or merely asserted. Ask whether its proof of reserves covers the tokens you actually hold. And remember that no custody arrangement removes market risk — cold storage protects against theft, not against prices falling. What it does protect is the thing users discovered they cared about most on October 29: that the coins are still there when you ask for them back. Follow exchange coverage on the Zimbuck News page and in the Zimbuck Market News group. Join the conversation on Zimbuck to say which custody fact you check first — cold-storage share, proof of reserves, or withdrawal history. FAQ. What does Coinbase mean by 99% in cold storage? That more than 99% of customer assets are held in offline wallets whose private keys are never connected to the internet, so a server or laptop compromise alone cannot reach them. What is proof of reserves, and why does 44 tokens matter? A published, cryptographically checkable report of the assets an exchange holds. Covering 44 tokens instead of 10 means far more of what users actually hold is verified, not just the largest coins. Has Binance repaid the $6.3 billion hack? Binance says approximately 98% of affected assets have been replenished and that it will cover customer losses; replenishment from its own resources is distinct from recovering the stolen funds themselves. What happened in the Arkéa case? ZachXBT linked over $133 million of suspicious exchange-account withdrawals to Crédit Mutuel Arkéa; Bitquery traced about $108.8 million in USDC from Kraken, Crypto.com and OKX accounts; Crypto.com blocked linked funds and Arkéa says the attack is now under control. Does cold storage protect against price falls? No. It protects against theft and unauthorised movement, not market risk — your coins can still lose value while being perfectly safe in custody. This article is market news and general information only, not financial advice.