Is Coinbase Safe? Licences, Breaches and Account Security in 2026

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Is Coinbase safe? For most people, yes: Coinbase is one of the most heavily regulated crypto exchanges in the world, a listed company on Nasdaq since April 2021, licensed in the European Union under MiCA and supervised by financial regulators on both sides of the Atlantic. There is no known case in which attackers drained Coinbase’s own wallets. The weak spots lie elsewhere: in customer data that leaked through bribed support contractors and suppliers, in phishing scams that use this data, and in the simple fact that crypto on an exchange is held for you rather than by you. This guide shows what protects your Coinbase account, every major incident from 2021 to November 2026, what the insurance really covers, and the steps that make your own account safe.

Coinbase safety: the key facts

Regulation: in the EU, crypto services come from Coinbase Luxembourg S.A., licensed under MiCA since 20 June 2025 and supervised by Luxembourg’s financial regulator CSSF. In the US, Coinbase holds state money transmitter licences and received conditional approval for a national trust charter from the OCC in April 2026.
Custody: Coinbase says it holds customer assets 1:1 and does not lend them or act with them without your permission.
Insurance: crime insurance protects a portion of the digital assets in Coinbase’s storage systems against theft. Crypto is not covered by the FDIC or SIPC.
Incidents: no hack of Coinbase’s wallets, but several data incidents, the largest in May 2025 with 69,461 affected customers, and two fines from the Central Bank of Ireland.
Your part: most stolen funds are lost through phishing and fake support calls. A security key or passkey, a unique password and a hardware wallet for long-term holdings close most of these gaps.

For fees, the product range and our rating, read our Coinbase review. Here the question is safety alone.

Is Coinbase legit? Licences, regulators and the public company behind it

A crypto exchange is a platform that buys, sells and holds crypto assets for its customers. Whether it is safe starts with who supervises it, because a licence obliges the firm to keep customer assets separate, to monitor transactions under anti money laundering rules and to report to a regulator that can fine it. Coinbase is not one company but a group of licensed entities, each responsible for a different part of the service.

Sources: Central Bank of Ireland (press release of 6 November 2025), our reports on the Coinbase Ireland fine and the OCC approval, and the Coinbase help centre on US licences.

As a public company, Coinbase publishes financial statements every quarter and is audited once a year by an independent third party, as the law requires for listed firms. That does not make the exchange risk free, but it means losses, incidents and lawsuits have to be disclosed. The two Irish fines show both sides: the supervision works, and it found real weaknesses. In the larger case, from 23 April 2021 to 19 March 2025, 30,442,437 transactions worth more than 176 billion euros were not fully and properly monitored, about 31 percent of Coinbase Europe’s transactions in that period. In the smaller case, Coinbase Ireland broke its duties to safeguard client funds between November 2020 and August 2025. In the safeguarding case the regulator alleged no loss of client money, and Coinbase settled both cases.

Key security features: how Coinbase protects your account

The Coinbase security model has two layers. The first protects the platform: encryption at the core of its systems, a security team that watches for misuse, which is how the contractor cases below were found, and a Bug Bounty programme that pays researchers for reporting vulnerabilities. The second protects your Coinbase account, and here you decide how strong it is. According to the Coinbase help centre, these are the most important security measures:

Two factor authentication (2-step verification): every login needs a second factor besides the Coinbase password. Coinbase recommends a security key or a passkey, because both are bound to the real Coinbase website and cannot be phished like a code sent by SMS. Security key support covers hardware keys such as YubiKey.
PIN and biometric authentication: the mobile app can be locked with a PIN, Touch ID or Face ID, so a stolen, unlocked phone does not open your account.
Devices and sessions: under the security settings you see every authorised app, all web sessions and confirmed devices, and you can remove any of them at once.
Email confirmation: new devices are confirmed by email, which is why your email account needs the same protection as your Coinbase account.
Password rules: at least eight characters with upper and lower case letters, a number and a symbol. A password manager creates and stores a strong password that you use nowhere else.

Coinbase employees will never ask for your password. Coinbase also never asks for your 2FA codes and never asks you to move crypto to a new address or another account. Anyone who does is not Coinbase, whatever the caller ID shows.

What is protected: 1:1 custody, crime insurance and your bank account balance

On the Coinbase security page the exchange states that it holds customer assets 1:1: your crypto is your crypto, and Coinbase does not lend it out or act with it without your permission. This matters because the collapse of FTX in 2022 happened exactly where an exchange used customer deposits for its own business.

The insurance is narrower than many users think. According to Coinbase, crime insurance protects a portion of the digital assets held across its storage systems against theft, including cybersecurity breaches. Total losses may exceed what the insurance pays, and the policy covers a breach of Coinbase’s systems, not the loss of your own account to a phishing scam. Crypto assets are not insured by the FDIC or SIPC and may lose value.

Cash is treated differently, depending on where you live:

US dollars: Coinbase keeps customer dollars in FDIC insured bank accounts, credit union accounts and short term investments such as US Treasuries. Through pass-through insurance, a customer’s deposits are protected up to $250,000 per insured bank if that bank fails, together with any money the customer holds at the same bank directly.
Euros: a euro balance in the EU is not a bank deposit but electronic money issued by Coinbase Ireland. The firm must keep it safeguarded and separate from its own money. This is exactly the duty the Central Bank of Ireland found breached in October 2026.

Has Coinbase been hacked? Every major incident from 2021 to 2026

When people ask whether Coinbase has been hacked, they usually mean one of two things: an attack on the exchange’s wallets, or an attack on customers and their data. The first has not happened at Coinbase. The second has, several times, and the pattern is clear: the data leaves through people and suppliers around the exchange, then criminals use it to call or email customers with great precision.

Sources: Coinbase’s Form 8-K of 14 May 2025, the breach notice to the Maine Attorney General, BleepingComputer (3 February 2026) and our reports on the AWS outage and the Amplitude breach.

The incident of May 2025 is the one that matters most for the question whether Coinbase is safe. Criminals paid support agents to photograph customer records and then demanded $20 million from Coinbase to keep quiet. In its statement Coinbase refused, fired the agents involved, set up a reward fund of $20 million for information leading to the attackers and promised to reimburse customers who had been tricked into sending crypto to the scammers. The customer data in the leak included names, addresses, phone numbers, email addresses, the last four digits of Social Security numbers, masked bank account details, images of identity documents and account balances. Coinbase estimated the cost of remediation and reimbursement at $180 million to $400 million. Login credentials and private keys were not part of it, which is why the exchange itself was never at risk. Its customers were, because whoever holds such data can call you, quote your balance and sound exactly like Coinbase support.

What the Binance hack means for Coinbase users

On 29 October 2026, attackers drained Binance’s hot wallets. Blockchain analytics firm TRM Labs counted $6.36 billion leaving Binance wallets on ten blockchains, most of it within about 20 minutes, and attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI also blamed for the Bybit hack (details in our report on the Binance hack). Coinbase was not the target. The lesson still applies to every crypto exchange: hot wallets are wallets connected to the internet so that withdrawals can be paid out quickly, and they are the part an attacker aims for. What protects you is an exchange that keeps only a small share of customer assets in hot wallets, insurance for that share, and your own decision how much you leave on any exchange at all.

Where the real risk sits: phishing scams, SIM swaps and fake support

For a normal Coinbase user the greatest danger is not a hack of Coinbase’s systems but a stolen account. The methods are always the same three:

Phishing scams: fake emails, text messages and search ads that lead to a copy of the Coinbase login page. Whoever types the Coinbase password and the 2FA code there hands both to the attacker in real time. Stolen logins from other online accounts are tried on Coinbase as well, which is why a password you reuse elsewhere is a risk.
SIM swaps: the attacker persuades your mobile carrier to move your phone number to a new SIM card and then receives your SMS codes. A security key or passkey ends this attack, because neither depends on your phone number.
Fake support and remote access: a caller who knows your name, address and balance warns you of a hack and asks you to move your crypto to a “safe” address or to install a remote access tool. Coinbase never does this. Malware such as keyloggers and remote access trojans can also steal login credentials from an infected computer.

Since the leaks of 2025 and 2026, these approaches are more convincing than before, because the criminals often work with real customer data. The defence is simple: never act on an inbound call or message, close it, open the Coinbase app yourself and check there.

Step by step: how to make your Coinbase account more secure

Use a unique, strong password from a password manager, used nowhere else.
Switch 2-step verification to a security key or passkey and remove SMS as a method once the key works.
Protect your email account with its own security key or authenticator app, because Coinbase confirms new devices by email.
Turn on PIN and biometric authentication in the Coinbase app.
Check your sessions and confirmed devices once a month and remove anything you do not recognise.
Keep your operating system and browser updated and install apps only from the official stores.
Treat every inbound call as a scam. Coinbase support never calls to ask you to move funds, share codes or install software.
Move long-term holdings to a hardware wallet and leave on the exchange only what you plan to trade.

If you notice unauthorised transactions or a login you do not recognise, lock your account at once through Coinbase’s account recovery and help pages, change your Coinbase password and email password, and report the case to Coinbase customer support from inside the app.

Is Coinbase Wallet safe? Exchange account versus self custody

Coinbase offers two very different products, and the answer to “is Coinbase safe” differs for each. The Coinbase exchange account is custodial: Coinbase holds the private keys for you, you log in with email, password and 2-step verification, and if you lose access, Coinbase can restore it after identity verification. Coinbase Wallet is a self custody wallet: the private keys are created and stored on your own device, not on Coinbase servers, and only you can move the coins. Instead of a password reset there is a 12 word recovery phrase. Whoever has it controls the wallet, and whoever loses it without a backup loses access for good.

That shifts the risk. A self custody wallet is not affected if Coinbase’s systems or Coinbase employees are compromised, and Coinbase cannot freeze it. In return you are solely responsible: there is no insurance, no reversal of a transaction sent to the wrong address, and the most common losses come from a recovery phrase typed into a fake website or from approving malicious smart contracts on the decentralized web. Keep the recovery phrase offline on paper or metal, never as a photo or in cloud storage, and read every approval before you sign it.

Is it safe to keep money on Coinbase? Exchange, wallet app and hardware wallet compared

The practical answer for most people is a combination: keep on the exchange what you trade and move what you hold for years to a hardware wallet. A hardware wallet stores the private keys offline and signs every transaction on the device itself, so neither a hacked computer nor a phishing page can move your coins without your confirmation on its screen. Coinbase Wallet supports Ledger devices for this. How such a device works is explained in our guide What is a hardware wallet?, and current models with prices are in our hardware wallet comparison.

For the crypto you leave on an exchange, the EU adds a layer of protection that did not exist before 2025: under MiCA, an exchange that holds crypto for its customers must keep it legally separate from its own assets, so that creditors cannot claim it if the firm becomes insolvent (Article 75 of the MiCA Regulation). This is a duty Coinbase Luxembourg has to meet for its EU customers, and the reason why a MiCA licence is the first thing to check at any crypto exchange.

Is Coinbase safe, and what does it cost? Fees for a $1,000 purchase

Safety and price come together at Coinbase: the exchange is regulated and well protected, but not cheap. On Coinbase Advanced, the order book for trading, the trading fee at the entry level is 0.6 percent, which is $6 on a purchase of $1,000. The simple buy button in the app costs more, because Coinbase adds a fee that depends on the payment method, up to 1.875 percent, plus a spread built into the price. All routes, with withdrawal and staking costs, are in our guide to Coinbase fees.

Our verdict: is Coinbase safe?

Coinbase is a safe crypto exchange by the standards that can be measured: MiCA licence in the EU, supervision in the US, 1:1 custody, a listed parent company that has to disclose incidents, and no known theft from its own wallets. Its record on customer data is weaker, and the fines from Ireland show gaps in compliance. For you this means: Coinbase is a sound place to buy and trade crypto, provided you protect your Coinbase account with a security key, treat every call claiming to be Coinbase support as a scam, and keep long-term holdings in self custody.

If you decide on Coinbase, you can open an account at Coinbase and set up the security key right after sign up. If you want to compare first, our comparison of regulated crypto exchanges lists the MiCA licensed alternatives with their fees, and our Kraken review covers the closest competitor.

FAQ: Is Coinbase safe?

For amounts you trade, yes: Coinbase is licensed under MiCA in the EU, supervised in the US and holds customer assets 1:1. For long-term holdings a hardware wallet is safer, because on an exchange Coinbase holds the private keys and your account can be targeted by phishing. Protect it with a security key or passkey.

There is no known case in which attackers drained Coinbase's own wallets. Customer accounts and data were hit several times: about 6,000 accounts in 2021 through a flaw in SMS recovery, data of 69,461 customers through bribed support contractors in 2025, and contact details through the analytics vendor Amplitude in October 2026.

Only in part. Coinbase carries crime insurance that protects a portion of the digital assets in its storage systems against theft, including cyber attacks on Coinbase. It does not cover losses from your own account being phished, and crypto is not insured by the FDIC or SIPC. US dollar balances have pass-through FDIC insurance up to 250,000 dollars.

According to the Coinbase help centre, the most common reasons are a hold on cash you deposited recently, which can only be withdrawn once the hold clears, a restriction on your account that requires more identity verification, or a crypto transaction that is still pending on the network. The app shows which applies; never follow a caller who offers to unlock it.

On Coinbase Advanced the entry level trading fee is 0.6 percent, which is 6 dollars on 1,000 dollars. The simple buy button in the app costs more: Coinbase adds a fee of up to 1.875 percent depending on the payment method, plus a spread in the price. The preview before each order shows the full cost.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

How to store crypto safely: protect yourself from hacks like the one at Binance

After the $6.3 billion hack at Binance: how to store your cryptocurrencies safely. Hardware wallets compared, wallet scanners such as MetaMask Security Alerts, the key settings on your exchange account and a seven-step checklist.

November 2, 2026 12:27 AM

Tampered hardware wallet bought in a store: your rights as a buyer under German law

On October 28, Singapore police found malicious hardware components in hardware wallets sold in stores, with losses of around 3.5 million Singapore dollars. What German sales law gives you against the retailer, and why it does not replace the lost coins.

October 31, 2026 12:37 PM

Floin Cyberattack: MiCA Crypto Platform From Liechtenstein Goes Offline

Liechtenstein-based crypto platform Floin reports a cyberattack, remains offline and has now confirmed a data breach. What is known about the MiCA-licensed company, which customer data may be affected and what investors should do now.

October 31, 2026 12:37 AM

Binance Alternatives: 4 MiCA-Licensed Exchanges Compared

After the hack of 29 October 2026, many Binance customers are looking for a new home for their coins. Bitpanda, Kraken, Bitvavo and Coinbase are licensed under MiCA. Here are their fees, supervisors and a five-step guide to moving.

October 31, 2026 12:04 AM

Is Gold a Safe Haven? Gold Price Falls 27% From Its Record as Stocks Crash

Gold fell 3.6 percent on the day US stocks crashed and is now 27 percent below its January record. Our comparison of six crises since 2007 shows when gold protects investors, when it fails and what would make it a safe haven again.

October 30, 2026 3:32 PM

Binance puts the hack at $6.3 billion: what you can do now

Binance names a cause itself for the first time: a compromised laptop belonging to a DevOps engineer is said to have opened access to a service container, while private wallet keys are said not to have leaked. The exchange estimates the total damage at around $6.3 billion, with about $3 billion considered frozen.

October 30, 2026 9:14 AM

How Much Would It Take to Bankrupt Binance? The $6 Billion Hack Explained

Binance lost $6.3 billion in the biggest crypto hack ever. How much would it take to bankrupt the exchange, and what does it mean for the crypto market?

October 29, 2026 9:38 PM

Binance Hack: Around $2.8 Billion Drained From a Hot Wallet

On Thursday evening, roughly $2.8 billion left the Binance wallet “Binance 14” within minutes. The attacker had tied the wallet to their own contract via EIP-7702. Tether and Circle have frozen about $2.4 billion, and Binance says it is investigating.

October 28, 2026 12:51 PM

Keystone destroys 18,835 hardware wallets, shipping on hold

The break-in on Keystone's website leaked the key owners use to verify their hardware wallet. Because it sits in the chip from the factory, the maker is destroying 18,835 finished devices and has halted shipping.

October 28, 2026 9:30 AM

Data breach at Coinbase vendor Amplitude: contact details exposed, balances untouched

Coinbase traces a security incident to the analytics vendor Amplitude and names email addresses and phone numbers as exposed. Balances, passwords and private keys are untouched according to the exchange, and notification goes out by email.

October 26, 2026 9:24 PM

Hardware wallet after the data breach: four ways to order without a home address

Keystone has confirmed a data breach and Trezor lost customer data at its logistics provider: the keys stayed safe in both cases, the delivery addresses did not. This piece shows the four routes to obtaining a hardware wallet in Germany without writing your home address into the next database.

October 26, 2026 12:00 PM

Bitcoin Wallet Bug: Why Speeding Up a Payment Could Drain Your Wallet

A Bitcoin wallet bug let rogue servers swap a real payment for a fake one and trick users into signing it. How the fee bump trap works and how to stay safe.

October 26, 2026 12:26 AM

Keystone confirms data breach: “We owe you an apology”

Hardware wallet maker Keystone has disclosed a break-in at its web shop: customer names, delivery addresses and order details were taken. Recovery phrases and private keys are not affected, the company says, and the real risk lies with phishing and the home address now in the open.

October 25, 2026 3:31 PM

Electrum wallet vulnerable before version 4.8.3: what you can do now

Electrum released version 4.8.3 on October 23, 2026 and closed a flaw that malicious servers had already exploited. It does not harvest your keys; it targets the moment you speed up a stuck transaction.

October 22, 2026 4:17 PM

Railway hack hits crypto bots and wallets: what to check and replace now

US host Railway reports possible access to its customers' secrets. For crypto bots and wallets that is particularly dangerous: analysts already count outflows of around $371,000.

October 21, 2026 4:31 PM

Polkadot reports a key leak at Fearless Wallet, 17,286 DOT are gone: how to check your extension

Context: on October 21 the Polkadot Community Foundation reported four versions of the Fearless Wallet extension as compromised. Anyone who has used it since February 2025 needs new keys, not a new password.

October 19, 2026 1:14 AM

Qubic halts its mainnet after 1,404 wallets are drained: the seed was the weak point

An attacker drained 1,404 Qubic wallets on the night of October 18, roughly $1.3 million. The protocol was not to blame: seed generation in the browser supplied too little randomness.

October 14, 2026 1:36 AM

MediaMarkt and Saturn halt Ledger sales after a customer reports an implant

Since October 13 MediaMarkt and Saturn have sold no Ledger devices, neither in store nor online. The trigger is a customer's report of an implant. What Ledger confirms, why the authenticity check does not help, and which steps make sense for devices bought in a store.

October 11, 2026 4:50 AM

90 Crypto Kidnappings and Robberies in 7 Months: Why France Is the Most Dangerous Country for Bitcoin Holders

France logged 90 crypto kidnappings, extortions and violent thefts this year, one every 2.5 days. Leaked tax data is to blame. Here is how to protect yourself.

October 10, 2026 4:26 PM

Revolut data breach: the bank pays for new ID documents for 680 customers, and what you can do now

Revolut will cover the fees for new identity documents where customers hit by the data theft need them. 680 accounts are affected, and for crypto holders a leaked KYC record weighs more heavily than a blocked card number.

October 10, 2026 3:39 PM

Will AI Break Bitcoin? Vitalik Says Prepare for "Bunker Mode", Hoskinson Calls It Numerology

Vitalik Buterin says AI could crack crypto's encryption within 2 years. Charles Hoskinson says that is nonsense. Who is right, and what should you do?

October 9, 2026 5:36 PM

Ledger Hack? $86 Million Drained: What Is Behind the Tampered Wallets From Southeast Asia

Since Friday, Ledger users in Southeast Asia have been reporting empty wallets, and analysts count more than $86 million. Ledger has halted the reseller CryptoBilis. An implant inside the device reportedly reads the seed phrase. What is known, what CZ advises and what you should do now.

September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.

September 16, 2026 4:19 AM

Check Your Safe Wallet Modules: How One Module Moved $7.7 Million Without a Signature

On September 15, 2,882 rsETH drained out of a Safe multisig without a single owner signing. An enabled module was to blame, and this is how you check your own wallet in five minutes.

September 4, 2026 10:15 PM

Trezor Data Breach: Am I Affected and What Should I Do Now?

Trezor widened the ShipMonk data breach on September 4, 2026: around 67,000 further people affected, just over 80,000 in total, from orders placed between November 2019 and August 2021. How to check in two minutes whether you are among them, and what an exposed home address means for self-custody.

August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.

August 13, 2026 4:59 PM

Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed

A breach at Trezor shipping partner ShipMonk exposed names, phone numbers and home addresses of 13,689 customers in August; in September Trezor reported roughly 67,000 more in the US. Devices are safe, phishing risk is not.