CoinJar

Is CoinJar safe?

CoinJar is one of the better-regulated Australian exchanges and has a long clean record. In 13 years we found no theft from its wallets, and it is the only Australian-founded exchange we cover with an EU MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence. What holds it back is that you cannot verify its reserves, and its terms make CoinJar the counterparty to your trades rather than a neutral venue.

We score CoinJar 71/100, a little below Independent Reserve (75) and well above Swyftx (59) and CoinSpot (52).

Which CoinJar company holds your money

CoinJar runs separate companies for each region, and which one you deal with decides your protection.

The MiCA licence is the strongest of the three. It brings EU rules on safeguardingSafeguardingThe legal duty of payment and e-money firms to keep customer money separate from their own, so it can be returned if the firm fails.More in the glossary client assets, governance and capital. The UK and Australian registrations are anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary regimes: they check who runs the company and how it screens customers, not how it keeps your coins. CoinJar's UK pages say plainly that UK customers have no access to the Financial Ombudsman Service or the FSCSDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary.

In Australia the CoinJar Card is issued by EML Payment Solutions under EML's financial services licence, with CoinJar as its authorised representative. That covers the card, not the exchange.

How CoinJar stores coins

CoinJar's terms say it keeps at least 90% of all crypto, customer assets included, in cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary, multisigMultisigA crypto wallet that needs approval from several keys to move funds, for example any 2 of 3, rather than from a single key.More in the glossary or MPC walletsMPC walletA crypto wallet that splits the private key into several shares held in different places, so no single device or company holds the whole key.More in the glossary, using technology from BitGo and Fireblocks. Part of the balance is held by BitGo Trust Company, a South Dakota trust company, which carries insurance. The terms are candid about its limits: the policy does not cover all balances and does not pay for losses from a hacked CoinJar account or a transfer you approved.

Two points weigh on the custody score. First, the terms say "CoinJar acts as principal at all times": even on CoinJar Exchange, the company is the counterparty to every trade. Second, we found no clause in the Australian terms saying customer coins are held on trust for you. In an insolvency, that wording matters.

Reserves you have to take on trust

CoinJar's security page says it maintains "full currency reserves at all times", enough to cover more than 100% of customer balances. It has not published a Merkle-treeMerkle treeA way to combine many records into one short code, so that each person can check their own record is included without seeing anyone else's.More in the glossary proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary, an attestation by an accounting firm or audited accounts on its website. Many offshore exchanges at least post self-made reserve reports, so CoinJar's reserves score of 35 is low for an exchange that is otherwise well run.

A quiet security and legal record

We found no hack of CoinJar's wallets and no enforcement action by AUSTRAC, ASIC, the FCA or the Central Bank of Ireland. In 2014 it told customers it was not exposed to the transaction-malleability problem behind Mt. Gox's collapse, and in 2025 that it did not use Safe{Wallet}, the service attackers compromised to rob Bybit.

How to use CoinJar more carefully

1. Switch two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary from SMS to an authenticator app.
2. Check which CoinJar company your account is with; EU customers have the strongest rules behind them.
3. Do not count on BitGo's insurance: it covers only part of balances and never a stolen login.
4. Keep long-term holdings in your own wallet, since CoinJar is the counterparty to your trades and publishes no reserves.
5. From 9 April 2027, when the new Australian regime starts, watch for CoinJar Australia's ASIC licence, which would bring custody standards to Australian accounts.

How we scored it

Security history (90) and legal record (88) are CoinJar's strongest factors: no theft and no enforcement in 13 years. Licensing (75) credits the MiCAMiCAThe EU's Markets in Crypto-Assets Regulation, which requires crypto exchanges and other providers to be licensed and supervised.More in the glossary licence and the FCA registration, but Australia, its home market, has only an AMLAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary registration. Reserves (35) are the weakest factor, because nothing is published to check, and custody (60) reflects principal trading and no trust clause.