Coinbase

Is Coinbase safe?

Yes, by the standards of the crypto industry. Coinbase is a US-listed company with audited accounts, a New York BitLicenseBitLicenseNew York's licence for crypto businesses, issued by the state's financial regulator (NYDFS). It is one of the strictest crypto licences in the US.More in the glossary and an EU-wide MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence, and its own wallets have never been drained by hackers. We score it 80/100, in the top quarter of this category and a few points behind Kraken (84), which has a cleaner security record.

The catch is people, not code. In May 2025 Coinbase disclosed that criminals had paid support contractors outside the US to copy customer data, and that the leak was being used to talk customers out of their money. It is a reminder that a well-run exchange still holds your ID, address and balances, and that this data is valuable to thieves.

What happened in the 2025 data breach

The timeline, from Coinbase's own filings and its notice to the Maine attorney general:

Date	Event
26 Dec 2024	First unauthorised access by bribed support staff
Early 2025	Coinbase detects and fires the insiders
11 May 2025	Attacker demands a $20 million ransom; Coinbase refuses
14 May 2025	8-K filing estimates costs of $180–400 million
Late May 2025	Notice says 69,461 people affected
Full year 2025	$311.2 million paid in cash, mostly voluntary reimbursements (10-K)

The stolen data included names, addresses, phone numbers, emails, the last four digits of Social Security numbers, masked bank details, images of passports and driving licences, and balance and transaction history. Passwords, private keys and two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary codes were not taken.

The real damage came afterwards. Scammers posing as Coinbase staff could quote a victim's address and balance, which made fake "your account is at risk, move your coins" calls very convincing. Coinbase voluntarily reimbursed retail customers who sent funds to the attackers; its 2025 annual report puts the cash paid out on the incident, including legal costs, at $311.2 million. We count that as a serious security failure that was handled responsibly, which is why security history scores 72 rather than 90+.

An earlier episode in 2021, when attackers used a flaw in SMS account recovery to break into several thousand accounts, also ended with Coinbase repaying the affected users.

Can you check that Coinbase holds your crypto?

Coinbase takes a different route from offshore exchanges. It does not publish a Merkle-treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary. Instead, its annual 10-K report, audited by Deloitte, sets customer crypto and cash it holds in custody against matching liabilities on the balance sheet, and the SEC can act if those numbers are wrong. For overall solvency that is better evidence than a self-published snapshot, because an audit covers the company's debts and its own assets as well.

What it does not give you is a way to confirm your own balance is included. If that matters to you, Kraken's audited proof of reserves lets you check it.

Licences and regulators

Coinbase is one of the most heavily supervised exchanges in the world:

• New York: BitLicenseBitLicenseNew York's licence for crypto businesses, issued by the state's financial regulator (NYDFS). It is one of the strictest crypto licences in the US.More in the glossary, plus Coinbase Custody Trust Company, a New York-chartered trust.
• Rest of the US: money transmitter licences or exemptions in the other states.
• US federal: on 2 April 2026 Coinbase said the OCC had given conditional approval to charter Coinbase National Trust Company, a national trust bank for custody and market infrastructure that will not take retail deposits. Coinbase, Inc. keeps its New York BitLicense and state trust charter; the company has not said whether customer assets will move to the new bank.
• EU: a MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence granted by Luxembourg's CSSF in 2025, which it can use in all 27 member states.
• UK: CB Payments is an FCA-authorised e-money institutionE-moneyMoney held as a stored balance with a payment firm rather than as a bank deposit. It is safeguarded, not covered by deposit insurance.More in the glossary and registered for crypto.
• Ireland: Coinbase Europe was the group's EU base before the MiCA switch.
• Australia: Coinbase Australia Pty Ltd received an Australian Financial Services Licence from ASIC with a retail derivatives authorisation (announced 7 April 2026), for crypto and equity perpetuals; it has been registered with AUSTRAC since 2022.

Since 14 August 2025 Coinbase has also owned Deribit, the largest crypto options exchange, which it bought for about $4.3 billion in cash and shares. Deribit keeps its own licence from Dubai's VARA (conditional at the end of 2025, according to Coinbase's 10-K) and serves non-US customers; its derivatives accounts are not covered by Coinbase's US and EU licences, so check which entity you sign up with.

That regulation has a price. NYDFS found in January 2023 that Coinbase had let a backlog of more than 100,000 unreviewed transaction-monitoring alerts build up, and Coinbase paid a $50 million fine plus $50 million on compliance. In November 2025 the Central Bank of Ireland fined Coinbase Europe €21,464,734 after coding errors meant about 30 million transactions worth more than €176 billion were not properly screened for money laundering; the High Court confirmed the sanction on 12 January 2026. Neither case involved losses of customer funds, but both show compliance struggling to keep up with growth. The SEC's 2023 lawsuit, which alleged Coinbase ran an unregistered securities exchange, was dismissed at the SEC's request in February 2025.

Custody: what you actually own

Coinbase says customer assets are held 1:1 and are not lent out unless you opt in to a product that does so. In 2022 it added a risk-factor warning that customers could be treated as unsecured creditors in a bankruptcy, then changed its user agreement to state more clearly that custodial assets belong to customers. That is about as good as it gets for a retail exchange, but it is untested in court. Crypto is not covered by FDICDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary or SIPC insurance. Coinbase's separate self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary app, where you hold the keys yourself, is reviewed on our Coinbase Wallet page.

How to stay safe on Coinbase

1. Turn on a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary or a hardware security key in Settings > Security. Avoid SMS codes, which can be stolen with a SIM swap.
2. Turn on the address allowlist so withdrawals can only go to addresses you have saved, with a waiting period for new ones.
3. Assume every inbound call or text claiming to be Coinbase is a scam. Coinbase never asks you to move coins to a "secure" wallet.
4. Do not keep more on any exchange than you need for trading. For long-term holdings, a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary removes the counterparty risk entirely.

How we scored it

Licensing (95) and audited reserves (90) are the strongest factors. Legal record (62) is the weakest, dragged down by AMLAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary fines in New York and Ireland, and security history (72) loses points for the 2025 insider leak, even though Coinbase's own wallets have never been hacked.