A hot wallet only contains about 5% of the bitcoins the company has.
Meanwhile, the other 95% of bitcoins they're holding are stored savely in a key-split cold wallet.
Now, the problem is: if some user wants a large amount of his bitcoins out of coinbase, the guys owing their part of the split private key need to take action to transfer that amount of bitcoins from the cold to the hot wallet, assuming the amount is > 5%.
So what I think "Vault" does is give them a better architecture for planing and organizing their hotwallet-coldwallet-process.
"To complete the Coinbase Vault offering, we will be adding multi-signature (“multi-Sig”) technology in the coming weeks to enable customers to manage their own vault security."
It's not clear exactly how that will work, but if it's, say, 2-of-3 and Coinbase only holds one of the keys then it would.
If they truly have cold storage of their btc - yes, this system does improve security, as their cold-storage bitcoins aren't subject to electronic hacking, just physical intrusion. And, the use of encryption and HSMs can mitigate against even a physical intrusion as well.
Sometime in the next couple years, someone is going to come up with a relatively fool proof vault storage for bitcoins, we just haven't see it yet. (And Coinbase isn't sharing enough details yet for us to know whether they've put one together)
The question means all of our Bitcoin at Coinbase. He's not making a conspiracy theory out of it - he's asking a legitimate question about whether or not Coinbase has all deposits accounted for or not.
That's a rationalization around the original blaming statement you made. You asked how we should know if they are secure. He said how do you know they haven't been hacked already? Both legitimate, up to the point you said he was making conspiracy theories.
I assumed he was talking like they had just spent the bitcoin (Mt Gox stylee). Even if they were hacked, I would expect Coinbase to disclose that information--to presume that they've been hacked, lost bitcoin, and are hiding that from everyone is a pretty wild theory in my book.
The keys are stored offline, but the BTC are always online. They are relatively safe against someone compromising your computers remotely. Against physical intrusions or insider attacks, not as much.
Physical intrusions can be dealt with by encrypting the keys, which I hope they are doing. Using a secret sharing scheme with physical tokens (e.g. smartcards) carried by chosen employees should reduce the danger of both of those attacks.
