Coinbase uses cold storage. They have some reserves in hot storage, but presumably less funds accessable makes them a smaller target. Correct me if I'm wrong, but I believe they are able to pull this off because they aren't technically an exchange. Coinbase Exchange may be all in hot storage, but they provide a seamless way to transmit your exchange reserves to a cold storage backed wallet.