I remember an interview with CEO Brian Armstrong where he said that he doesn't have access to any of Coinbase's cold wallets. In order to gain access to these funds, different members within Coinbase have to sign.
It's cool and all that cold wallets are being secured properly, but hacks and insider thefts most of the times concern hot wallets, and these hot wallets can be emptied by every employee who knows where to dig.
In most cases when it concerns insider thefts, you see that before the actual theft the hot wallet has been topped up (in some cases topped up beyond their regular top up amount) and then emptied.
that's probably not the end of the world in coinbase's case. according to them, they keep <2% of crypto in hot wallets, and the hot wallets are fully insured in the case of a hack or inside job:
Quote
Coinbase prioritizes the security of our customer's funds, all digital currency that Coinbase holds online is insured. If Coinbase were to suffer a breach of its online storage, the insurance policy would pay out to cover any customer funds lost as a result. Coinbase holds less than 2% of customer funds online. The rest is held in offline storage.
Please note that the insurance policy covers any losses resulting from a breach of Coinbase’s physical security, cyber security, or by employee theft.
Please note that the insurance policy covers any losses resulting from a breach of Coinbase’s physical security, cyber security, or by employee theft.
if the cold wallets are ever breached, the shit will hit the fan though.
That's around 13.2 Million US dollars and I think that number is outrageous specially if those funds are from their clients. With that kind of number I don't think that the South Korean government will be silent on this one and I think big sanctions will be slap on Bithumb especially if they won't do anything to compensate their clients. Another thing that I see the South Korean government is doing is they would seriously change their regulations towards crypto exchanges when it comes to their security, which obviously hasn't improve. 
