They are regulated, so before they were given a license, regulators required them to have a system in place and continuesly monitoring them to ensure that any entrusted bitcoins would be safe. Aside from crime insurance, which partially covers any lost BTC, they also have highly sophisticated security measures.
Yes, as I've said here several times now, clearly Coinbase has very, very good security measures, like any bank or financial institution has. I would trust Coinbase much more than I would trust holding my own personal keys, for instance.
But even with the use of cold storage, there is a non-zero chance of them losing their Bitcoin keys, or for them to be lost or destroyed. Again, just like any bank: it's extremely rare that a bank will lose people's funds, because their license requires strong safety standards (27001 for instance).
I'm only saying that, in the case of an FDIC insured bank, then if the unthinkable happens, then customers will not lose money. That is not the case for coinbase.
So only the 2% that's kept in hot wallets is more prone to hacking. The rest is stored in cold storage, making it much safer from cyberattacks.
Ah, okay, so 98% of their Bitcoin keys are "hack proof". "Absolutely impossible" to steal or destroy. If you make an absolutist statement like that in front of any serious infosec expert they will probably
throw something at you . Security is not an absolute thing. I'm not saying you shouldn't trust Coinbase in the same way you get on a commercial airliner and feel safe, but never say "never".
(As a side note, in case anybody was wondering: yes, I am in this exact business with
Haypenny. Like any digital currency we have to worry about infosec, and we take very strong measures to secure our data including keys physically held by two different roles that are kept physically apart. However, we
also have mitigation plans in case of a catastrophic hack that would limit damage to a tiny fraction of customers).