Is Coinbase Safe? What to Know Before You Use It
Is Coinbase safe? Separate company risk, account takeover and price risk, then see what the 2025 data incident means and which settings to switch on.
By Christopher Cannucciari · Published
Key takeaways
- “Safe” hides three questions: could the company fail, could someone take over your account, and could the price fall. No platform removes the third.
- Coinbase is US-listed and files public reports. Its SEC case was dismissed in February 2025, and a 2023 New York compliance settlement is part of the record too.
- In May 2025 Coinbase disclosed that bribed overseas support agents copied customer data. Passwords, private keys and funds were not taken, but the data helps scammers sound convincing.
- Crypto held at Coinbase is not covered by FDIC deposit insurance. Cash may qualify for pass-through insurance, which Coinbase does not guarantee.
- Most of what you control sits in your account settings: a passkey or security key, a withdrawal allowlist and a firm rule that Coinbase never phones you.
What does “safe” mean for an exchange?
It means three separate things, and Coinbase looks different on each. Platform risk is whether the company stays solvent and lets you withdraw. Account risk is whether someone else can log in as you or talk you into sending coins. Value risk is the price moving against you, which is the same on every platform and is explained in Why Is Bitcoin So Volatile?.
| Kind of safety | What could go wrong | What you can do |
|---|---|---|
| The platform | The company fails or freezes withdrawals | Check its record, keep only what you need there |
| Your account | Takeover, impersonation of “support” | Strong 2-step verification, never share codes |
| The value | The price falls | Only use money you could afford to lose |
This page applies How to Choose a Crypto Exchange to one company. Is Bitcoin Safe? gives the wider picture, and the Coinbase review covers products and costs.
Could the company itself fail?
Any company can fail, so look at the public evidence. Coinbase was founded in 2012, and its Class A stock has traded on Nasdaq under the symbol COIN since a direct listing in April 2021. As a listed company it files reports with the SEC, which you can browse through sec.gov, and its filings say it is registered with the federal government as a money services business, holds state money transmitter licenses and has a New York BitLicense.
Listing and licensing mean scrutiny, not immunity. Mt. Gox in 2014 and FTX in 2022 left customers holding claims instead of coins.
Two parts of the regulatory record are worth knowing. In June 2023 the SEC sued Coinbase, alleging it operated as an unregistered exchange, broker and clearing agency. On February 28, 2025, the two sides jointly agreed to dismiss the case with prejudice, so it ended by agreement and not by a court ruling. Separately, in January 2023 New York’s financial regulator announced a consent order after finding failings in Coinbase’s compliance program, including anti-money-laundering controls. Coinbase paid a penalty, agreed to invest further in compliance and to retain an independent monitor.
The harder question is what would happen to customer crypto in a Coinbase bankruptcy. Its SEC filings say it believes a court would not treat customer crypto as part of its estate, relying on a user agreement clause based on Article 8 of the Uniform Commercial Code. The same filings say courts have not yet tested this for crypto and that customers could be treated as general unsecured creditors if a court disagreed. That is an uncertainty and not a prediction, but it is a reason to keep on any exchange only what you need.
How are your cash and crypto held, and what is insured?
Coinbase says customer cash is held in pooled accounts at FDIC-insured banks, set up so that pass-through deposit insurance could apply up to the per-depositor limit. It does not guarantee that the insurance will apply. Crypto is a different matter: it is not covered by FDIC deposit insurance at all, which the FDIC explains at fdic.gov.
| What you hold at Coinbase | FDIC deposit insurance? |
|---|---|
| US dollars in your account | Possibly. The accounts are designed for pass-through coverage, but it is not guaranteed. |
| Bitcoin and other crypto | No |
| If Coinbase itself fails | Coinbase states that FDIC insurance does not apply |
Treat marketing words like “secure” or “protected” as claims, not coverage.
What happened in the May 2025 data incident?
In May 2025 Coinbase disclosed that criminals had paid overseas support contractors or employees to copy customer data from internal support tools, then demanded a ransom for silence. Coinbase refused to pay and offered a reward for information about the criminals.
The data included names, contact details, the last four digits of Social Security numbers, masked bank details, images of government ID, balances and transaction history. Later breach notifications put the number of affected people at roughly 70,000. Coinbase said passwords and private keys were not compromised and that the people involved could not reach customer funds. It said it would reimburse eligible customers who were tricked into sending funds to the attackers as a direct result.
Why does that matter to you? The data works as a script for fraud. Someone who knows your balance, recent transactions and the last four digits of your Social Security number can sound exactly like genuine support, and the realistic danger is a convincing call or message that gets you to hand over a code or move funds yourself. An earlier incident points the same way: in 2021 attackers abused a weakness in Coinbase’s text-message account recovery to reach some accounts, and reports at the time said Coinbase fixed it and reimbursed those affected.
Which security settings should you turn on?
Use a passkey or a hardware security key instead of text messages, and add a withdrawal allowlist. Coinbase itself recommends a security key or passkey. A short checklist:
- A passkey or hardware security key for 2-step verification. Coinbase also supports authenticator apps. Add a second method as a backup in case you lose your phone.
- No text-message codes where an alternative exists. Phone numbers can be hijacked, a trick covered in Common Bitcoin Scams and How to Spot Them.
- The address book allowlist. It limits withdrawals to addresses you saved earlier, and a new address only becomes usable after a waiting period, which gives you time to notice a theft attempt.
- A unique password and a protected email account. Email controls password resets.
- A bookmark for the real site and app. Never reach Coinbase through search ads or links in messages.
What do scams aimed at Coinbase users look like?
Most start with someone claiming to be Coinbase support or security. Coinbase says it will never call you and will never ask for your password, 2-step verification codes or remote access to your device. It also warns that scammers can spoof its real support number, so a call showing the right number is still not proof.
The usual script says your account is compromised and you must move your funds to a “safe” wallet that the caller controls. The red flags are familiar: you were contacted first, the matter is urgent, and you are asked to share a code or move money. Hang up, open the app yourself and contact support from there.
What should you do if you think you were hacked or scammed?
Act in this order.
- Stop. Do not send more funds or read out codes, even to “undo” the problem.
- Secure the account from a trusted device: change the password, review your 2-step methods and contact Coinbase through its app or official help page. You have to start any call yourself.
- Keep records: messages, addresses, transaction IDs and screenshots.
- Report it to the FTC at reportfraud.ftc.gov and to local police, and tell your bank if it was involved.
- Ignore paid “recovery” services. They target people who have already lost money.
Recovery is often not possible because crypto transfers are generally irreversible. Coinbase’s 2025 reimbursement pledge covered that specific incident, so do not assume it applies elsewhere.
Should you hold your own keys instead?
Self-custody swaps company risk for your own. At an exchange, Coinbase holds the keys and you hold a claim against it. With your own wallet, nobody can freeze your coins or reset your password, but nobody can rescue you if you lose the backup either.
Coinbase also offers a separate self-custody wallet app, the Base app, formerly Coinbase Wallet, which it describes as a different product from a Coinbase account. Many people split their holdings: a small amount on an exchange, long-term holdings in their own wallet. The Power of Self-Custody covers the trade-offs, and How to Buy and Secure Bitcoin turns it into steps.
Who does Coinbase suit, and who does it not?
Coinbase tends to suit someone who wants a familiar interface from a listed US company with public reporting, will set up a passkey or security key, keeps on the platform only what they need, and accepts that custody means holding a claim on the company.
It does not suit people who want deposit insurance on their crypto, because there is none, or anyone unwilling to give up text-message codes and to treat unexpected “Coinbase” contacts as hostile. It is a poor fit if an account the company can restrict is unacceptable: the user agreement lets Coinbase suspend or restrict accounts, for example where the law requires it or where it suspects financial crime. It is also a weak choice for large long-term holdings left on the platform with no plan.
What is a sensible way to start?
Set up the passkey or security key before you deposit anything, make a small first purchase and test a small withdrawal to a wallet you control. If you decide to go ahead, Coinbase will ask you to verify your identity first. If you open an account through a link on this page, this site may earn a commission, which does not change any of the downsides described here.
New to Bitcoin? The Start Here path covers the basics in order. Crypto assets are volatile and you can lose money, and nothing on this page is personalized advice. For decisions about how much to hold and where, a qualified financial professional can look at your whole situation.
Last checked: 2 October 2026. Fees, features and availability change, so confirm them on the provider’s own site.
Where to go next
- How to Choose a Crypto Exchange: A Safety Checklist: the questions to ask about any platform.
- Common Bitcoin Scams and How to Spot Them: the red flags behind impersonation and fake support.
- The Power of Self-Custody: Owning Your Own Keys: what changes when you hold the keys yourself.
- Coinbase Review: What It Offers, How It Charges and Who It Suits: products, costs and trade-offs in one place.
Frequently asked questions
Is Coinbase safe to use?
It depends which risk you mean. Coinbase is a publicly listed US company that files reports with the SEC and holds US licenses, but it holds your keys, crypto is not covered by FDIC deposit insurance, and its customers have been targeted by impersonation scams. Your own security settings matter as much as the company's record.
Is money on Coinbase insured?
Crypto is not covered by FDIC deposit insurance. Coinbase says customer cash is held in accounts designed so that pass-through FDIC insurance could apply up to the per-depositor limit, but it does not guarantee that it will, and the insurance does not apply if Coinbase itself fails.
Has Coinbase been hacked?
Coinbase has disclosed two incidents worth knowing about. In 2021 attackers abused a weakness in its text-message account recovery to reach some customer accounts. In May 2025 criminals bribed overseas support staff to copy customer data. In the 2025 case, Coinbase said passwords and private keys were not compromised.
How do I make my Coinbase account more secure?
Use a passkey or hardware security key for 2-step verification instead of text messages, turn on the address book allowlist for withdrawals, use a unique password, and never share codes. Coinbase says it will never call you or ask for your password, verification codes or remote access.
What should I do if I think I was scammed on Coinbase?
Stop sending money, secure your account from a trusted device, contact Coinbase through its app or official help page, keep every record, and report the scam to the FTC at reportfraud.ftc.gov and to local police. Recovery is often not possible because crypto transfers are generally irreversible.
