Coinbase Wallet

Is Coinbase Wallet safe?

As a place to hold your own keys, yes. Coinbase Wallet has run since 2017 without a loss we could trace to its code, its smart-wallet contracts are open source and heavily audited, and Coinbase cannot sign for you. We score it 77/100, a B. The weak points are that you cannot inspect the app you install and that the app tracks you for advertising, which is unusual for a wallet.

The name has moved around. Coinbase renamed the app the Base App in July 2025, added a social feed, chat and mini-apps, then on 10 September 2026 switched back to Coinbase Wallet and refocused on trading. Throughout, it stayed a self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet.

Coinbase Wallet vs Coinbase: what is the difference?

They are different products from the same company. The Coinbase exchange holds your crypto for you, under licences and with an account that support can unlock. Coinbase Wallet does not hold anything: the keys live on your device or in your passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, and Coinbase cannot freeze, reverse or recover a transfer. The exchange's 2025 customer-data leak and its regulatory fines belong on the exchange page and are not counted here.

The wallet now also reaches out to perpetual futures run on Hyperliquid, tokenized stocks and prediction markets. Those carry their own risks and sit outside this score.

Recovery phrase or passkey: how your keys are stored

You can end up with one of two kinds of wallet.

Recovery phraseSeed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary wallet. The classic setup gives you a standard 12-word phrase, generated and kept on the device. You can write it down or upload an encrypted backup to iCloud or Google Drive, locked with a password you choose and Coinbase cannot reset. The phrase works in other wallets, so leaving is easy.

Smart wallet. Newer accounts are smart contract wallets controlled by passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary rather than a phrase. The passkey is stored and synced by your provider, such as Apple, Google or a YubiKey, and signatures are checked on-chain by an audited open-source contract. Coinbase says it never holds keys. The catch is that passkeys are bound to the keys.coinbase.com domain, so Coinbase's own documentation tells users to generate a recovery key in advance; without one, losing your passkey or losing access to that site can lock you out.

Both are reasonable models. Neither keeps keys on a dedicated device, and our rubric caps software wallets at 84 for that reason, so key management scores 76, between MetaMask and Trust Wallet.

Does Coinbase Wallet protect you from drainers?

It has had the basics since January 2023: transaction previews that simulate how your balances will change, and a highlighted alert when a dapp asks for permission to withdraw your tokens or NFTs. Both launched on Ethereum and Polygon. Coinbase also warns before you open dapps it has flagged as dangerous and hides scam tokens. Previews are estimates, Coinbase says, and every warning can be clicked past. We found less public detail on chain coverage and detection than for Phantom or MetaMask, so this scores 78.

Can you check the code?

Only part of it. The smart-wallet contracts are MIT-licensed on GitHub with four published reviews: Cantina in December 2023 and April 2024, Certora in February 2024 and a Code4rena contest in March 2024. The mobile app and browser extension, where your keys and signing actually happen, are closed source, and WalletScrutiny found no public code for them. Coinbase's HackerOne programme lists the Android and iOS apps and the Chrome extension as in scope for critical bounties, which helps. Transparency scores 60.

Privacy: what the app collects

The App Store privacy label is the weakest part of the picture. It says identifiers such as a device ID may be used to track you across other companies' apps and websites, and lists usage data linked to you for third-party advertising. Financial information, coarse location and browsing history are collected but not linked to your identity. The wallet needs no ID check, but your on-chain addresses and a device ID in an ad network are not a comfortable mix. Company record scores 70.

How to stay safe with Coinbase Wallet

1. If you use a smart wallet, generate a recovery key now and store it offline, and secure your Apple or Google account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary.
2. If you use a phrase wallet, keep a paper or metal copy even if you also have a cloud backup.
3. Treat calls or messages from "Coinbase support" about your wallet as fraud. Support cannot see or move self-custodySelf-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary funds.
4. Turn off ad tracking in your phone's settings if you want to limit what the app shares.
5. For larger sums, connect a Ledger to the extension or move them to a hardware walletHardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary.

How we scored it

Security record (90) is the strongest factor: no loss traced to the wallet's own code in about nine years. Transparency (60) is the weakest, because the app is closed source even though the smart-wallet contracts are open and audited. Company record (70) reflects advertising tracking in the app, not the exchange's problems.