Coinbase does a mixture of “hot” storage online, and “cold” storage offline, with the offline portion being around 98%. This ensures maximal safety from hackers, while at the same time providing sufficient liquidity online so users’ buy sell orders are not held back.