The vault behind an exchange
Where does an exchange keep the coins it isn’t about to pay out? Mostly offline. Exchange Coinbase’s annual report for 2025, filed on February 12, 2026, defines cold storage as keeping private keys “in any fashion that is disconnected from the internet,” with offline computers, USB drives and paper records as examples.
Coinbase aims to keep no more than 2% of custodied assets in a hot wallet, and its auditor writes that the company holds crypto, its own and its customers’, primarily in its cold storage environment.
Key material for those cold wallets sits in facilities inside and outside the US, the filing says. One subsidiary has a legal reason too. Coinbase Luxembourg, according to the report, must hold its client assets in segregated cold storage under MiCA.
That auditor, Deloitte & Touche, named crypto held in cold storage a critical audit matter. To show Coinbase controls those keys, the firm says it decoded messages signed with selected keys or watched selected assets move.
Signing with the cable pulled
A cold key still has to sign something now and then. The usual answer is air-gapped signing, where the unsigned transaction is carried to the offline machine and the signature is carried back.
Bitcoin Core’s offline signing tutorial shows it with two computers. One holds the keys and is cut off from every network, “internet, Tor, wifi, bluetooth etc.,” and doesn’t even keep a copy of the blockchain.
The other runs a watch-only wallet that knows the addresses but holds no keys. It builds an unsigned transaction, the offline machine signs it, and the online one broadcasts the result. For carrying the watch-only wallet file across, the tutorial suggests a USB flash drive.
The file format comes from BIP 174, assigned on July 12, 2017 and now marked as deployed. Its stated aim is to let “air-gapped wallets and hardware wallets” sign without direct access to the chain’s record of unspent coins. A hardware wallet is the pocket version of the same idea.
The keys stayed cold, the money left
Cold storage stops keys from being copied over a network. It does nothing about what the signers agree to.
Exchange Bybit learned that on February 21, 2025. Its incident timeline says a routine transfer from one of its Ethereum multisig cold wallets to a warm wallet began at 13:30 UTC, with 30,000 ETH first. At 14:13 UTC the attackers used a spoofed version of the Safe multisig interface to change the wallet’s smart contract logic, then split the funds across 39 addresses.
One cold wallet lost $1.46 billion, including 401,347 ETH. The FBI’s public notice of February 26, 2025 put the theft at about $1.5 billion and blamed North Korea. Bybit said the same day that the credentials of a Safe developer had been compromised, letting the attacker deceive the signers into approving a malicious transaction.
Offline gear has its own weak spot, and a US investor bulletin from the SEC warns that cold devices “can be lost, damaged, or stolen.” When you weigh a custodian’s cold storage, ask who checks a withdrawal before it is signed, not only where the keys are kept.