Coinsquare

Is Coinsquare safe?

Coinsquare holds your coins well and has handled its business less well. The custody setup is among the best in Canada: coins are held in trust for you by Coinbase Custody and BitGo, under a dealer regulated by CIRO, and we found no theft from its wallets in twelve years. Against that sit a 2020 settlement in which it admitted faking most of its trading volume, and a 2022 breach that exposed customers' home addresses and balances.

We score Coinsquare 75/100. That is below its sister brand Bitbuy (80), which runs on the same dealer and custodians but without Coinsquare's history.

Who owns Coinsquare?

Coinsquare was founded in Toronto in 2014. In July 2023 it merged with WonderFi and CoinSmart; the fintech company Mogo, a large Coinsquare shareholder, came out with about 14% of WonderFi. On 1 June 2026 Robinhood Markets closed its purchase of WonderFi. Robinhood says Coinsquare and Bitbuy "will become part of the Robinhood brand" and is inviting Canadian customers to its app.

Both brands now run through one company, Coinsquare Capital Markets Ltd. (CCML), so they share a client agreement, custodians and regulator. What differs is history.

How your coins are held

The CCML client agreement is unusually clear:

The Canadian Investor Protection Fund covers cash only. If Coinsquare failed, the trust wording and the outside custodians are what would protect your crypto, which is a sounder footing than most exchanges give you. Coinsquare also says it holds its own "vault risk" insurance on top of the custodians'.

The 2020 wash-trading settlement

The Ontario Securities Commission approved a settlement with Coinsquare and three executives on 21 July 2020. Coinsquare admitted that between July 2018 and December 2019 it reported about 840,000 wash trades, worth an estimated 590,000 bitcoin and over 90% of its reported volume, that it misled clients who questioned the numbers, and that it took a reprisal against an employee who raised concerns. It was the OSC's first case for whistleblower reprisal.

The chief executive and president resigned and paid C$1 million and C$900,000; the compliance chief left and paid C$50,000. Coinsquare and its dealer company had to set up independent boards, appoint a new CEO and compliance officer and build a whistleblower programme before the dealer could be registered. That happened, and in 2022 it became the first crypto platform admitted as an investment dealer by IIROC, now CIRO. We found no enforcement since, but admitted market manipulation by the platform itself keeps legal record at 60.

The November 2022 data breach

On 19 November 2022 Coinsquare halted trading for "unscheduled maintenance" after detecting unusual activity. A week later it emailed customers that an intruder had reached a database containing names, email and home addresses, phone numbers, dates of birth, device IDs, public wallet addresses, transaction history and account balances. It said no passwords were exposed, no coins left cold storageCold storageKeeping crypto keys on a device or medium that is not connected to the internet, which protects them from most online attacks.More in the glossary and three client accounts were accessed.

No money was lost, which is why the security score stays at 80. But a list of crypto holders with home addresses and balances is a real risk for the people on it, through phishing, SIM-swap attempts and physical threats.

Reserves you cannot check yourself

Unlike Bitbuy, Coinsquare has never published a proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary that we could find. What it offers instead is regulation: a CIRO dealer is audited by an independent CIRO-approved accounting firm and supervised on its finances. WonderFi filed audited accounts while listed in Toronto, and Robinhood now consolidates it. That is reasonable assurance, but nothing a customer can verify.

How to use Coinsquare more safely

1. If you had an account in 2022, assume your address and balance are known to criminals. Be suspicious of any call, text or letter about your crypto.
2. Use an authenticator app for 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, never SMS, and a unique password.
3. Keep long-term holdings in your own wallet.
4. If you move to the Robinhood app, check the new agreement for the legal entity, the custodians and whether coins stay in trust.

How we scored it

Custody (85) is Coinsquare's strongest factor, thanks to trust-held coins at two qualified custodians. Legal record (60) is the weakest because of the 2020 OSC settlement. Security history (80) reflects the 2022 data breach without loss of funds, and reserves (70) the lack of any published proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary.