Coinbase says over 99% is offline: what withdrawal users can check

Start with what the percentage measures

The subject of the more-than-99% figure is customer assets. Decrypt reports Coinbase’s statement that it keeps those assets in cold storage and moves funds into internet-connected hot wallets as customers need them. FinanceFeeds likewise reports a small hot-wallet portion used for withdrawals and other activity, with balances adjusted as demand changes. The figure concerns the distribution of stored assets, as described by the company.

It gives no percentage for the probability that your withdrawal will succeed. It also supplies no deadline for an individual transfer. A reader cannot turn an asset-storage share into a claim that more than 99% of requests clear within a particular period. The denominator in the statement is assets, while a withdrawal-service measure would need requests and a defined observation window.

Consider the question you are trying to answer. Someone deciding how to interpret a security disclosure wants to know what is connected to online signing systems. Someone waiting for a transfer wants to know whether their request was accepted, whether a transaction was broadcast and whether the intended recipient has received it. Those questions need different records. An exchange-wide storage statement cannot identify a customer’s particular request.

Keep the company’s qualifier when quoting it. “More than 99%” is the reported wording. Writing exactly 99% would replace that statement with a different one. Neither opened report provides an asset-by-asset table that lets this article calculate the online amount for the token in your account. Applying the overall percentage to your personal balance would introduce an assumption the reports do not support.

Signing authority deserves a separate reading

Decrypt reports that Coinbase described private keys split into pieces and never fully reassembled, including during transaction signing. It also reports the company’s statement that no single employee has standing access to the hot-wallet signing service. FinanceFeeds describes distributed key protection and restrictions intended to prevent an employee from moving assets independently.

Our reading is that these claims address who can authorize a movement. The offline percentage addresses where assets are kept. A useful review asks how both fit together: what authority is needed to move assets from storage, and what checks operate when that movement is requested? The reports summarize the company’s controls, but do not provide a test of each permission or a reconstruction of a live signing operation.

That limits the comparison a reader can make. “Uses split keys” and “keeps more than 99% offline” describe different parts of a system. Combining them into a numerical safety score would need a method, comparable evidence and an explicit definition of failure. None is supplied here. We therefore keep the controls as separate attributed statements instead of announcing a winner.

SponsoredBinance

Partner rebate share25%Up to

Check regional eligibility and account terms

✓Code applied automatically by the sign-up link: 11350287

Sign up on Binance →Code11350287Copied

The distinction also helps when reading a report about compromised employees. A stolen credential, access to an internal service and authority to approve an asset movement are separate capabilities. Coinbase says its design requires multiple approvals for sensitive actions. That is the company’s stated response to the employee threat described in the coverage, rather than proof that every possible compromise has been tested.

A withdrawal pause needs transaction evidence

Decrypt reports that Coinbase described limits on transfers from cold to hot wallets and staff review of unusual withdrawal spikes. Both reports describe emergency mechanisms that can stop movements or take signing keys offline. A control intended to stop suspicious activity has a different purpose from a service promise about processing a customer’s transfer.

For an existing Coinbase withdrawal request, record what your account actually displays. Preserve the asset name, selected network, amount and destination. Save the request time with its timezone and the current status wording. If a transaction identifier is shown, keep it with the request record. These are reader checks, not a description of a particular Coinbase screen or a claim that every account exposes the same fields.

If no identifier is shown, retain the request reference available to you. Do not infer from the cold-storage percentage that the request has already reached a blockchain. If an identifier is present, compare the network and destination with your original intention. Use the receiving side’s record to establish whether the intended account or wallet has received the transfer.

A discrepancy should be described precisely when using the exchange’s existing support route. “My request shows this status at this time” is more useful than “your cold wallets must be empty.” The latter adds an explanation that neither the general disclosure nor a single pending request establishes. Ask about the request you can identify and keep its original details together.

The same restraint applies in the other direction. A completed transfer is evidence about that transfer. It cannot verify the platform’s full storage architecture. Customer records and company disclosures answer questions at different scales, so preserve both without asking either to prove the other.

Asset backing answers another question

Coinbase also said customer assets are held 1:1 and are not lent out unless customers direct it to, according to Decrypt. FinanceFeeds reports the same company position on backing and authorization. Those statements concern the assets corresponding to customer holdings and the permitted use of them. They do not turn the storage share into a withdrawal timetable.

When reading “held 1:1,” ask what is being asserted about the customer obligation. When reading “more than 99% offline,” ask what is being asserted about storage. When reading the description of multiple approvals, ask what is being asserted about authorization. This approach keeps three claims attached to the questions they can actually address.

For example, a customer can ask whether an identified transfer is waiting for an internal decision without asserting that the company lacks assets. Equally, a statement that assets are backed does not identify whether that customer’s transfer has been broadcast. The opened reports contain both security and backing statements, but do not connect them to any reader’s account record.

We have not derived a reserve ratio, an available withdrawal balance or a loss estimate from these statements. Doing so would require additional evidence about the measurement date, included assets and relevant obligations. The analysis here concerns how to read the reported claims and how to document an existing transfer.

Compare disclosures using the same question

The Binance incident is the context for Coinbase’s statements. It does not make differently described security systems directly comparable. A comparison based on one company’s offline share and another company’s incident amount would combine a storage measure with a loss measure. The resulting ranking would have no consistent denominator.

A more useful comparison starts with the same request for evidence from each platform: the scope of assets in the storage claim, the authority required to move them, and the stated response when unusual activity appears. Record which answers come from the company and which have outside verification. Two publications reporting one company’s explanation do not independently audit the explanation.

Timing belongs in that comparison as well. Decrypt’s publication time converts to 04:46 SGT on 5 November; FinanceFeeds dates its coverage 4 November. Neither report establishes that a customer’s current withdrawal is affected by an emergency control. A later account status must be assessed from the later record. Keep publication time separate from the time of the request you are checking.

Quick answers

Does more than 99% offline mean my balance is separately reserved offline?

The reported figure covers customer assets overall. The opened reports do not map an individual retail balance to a specified cold wallet. Preserve that difference when reading the claim. An account balance, an exchange-wide storage share and a particular on-chain address are different records.

Do the reports say how long my withdrawal should take?

They describe storage and security controls without providing a processing commitment for your request. Read the information attached to the actual transfer and retain its timestamp. If you need clarification, ask about that request’s current state rather than deriving a time estimate from the offline percentage.

What would improve the evidence beyond this disclosure?

For the architecture claim, further evidence would need to identify the scope and testing of the controls being described. For a pending transfer, the next useful evidence is a change in its recorded status, a transaction identifier where available, or confirmation from the receiving side. Save the new record with its time so it can be compared with the earlier one.