The short answer
- What Coinbase documents
- Over 99% of customer crypto in cold storage, assets held 1:1 and not lent out, mandatory 2-step verification, address allowlisting and audited financial statements filed with the SEC.
- The limits
- Crypto is not FDIC or SIPC insured, the crime insurance does not cover logins with your own credentials, and in 2025 bribed support agents copied some customers’ data.
- What depends on you
- Your 2-step method, whether you turn on allowlisting and whether you can tell real support from a scam.
Coinbase in the United States
- Coinbase publishes its state licences, including New York, on its licences page. A licence covers specific activities; it does not mean every product is offered in every state.1 source
Shown for your selected market. Other countries
Coinbase in the United Kingdom
- UK customers contract with CB Payments Ltd, authorised by the FCA for e-money and registered under the Money Laundering Regulations for specific cryptoasset activities (register number 900635). The UK user agreement was last updated on 16 October 2026.1 source
- To buy or sell, UK users complete a client categorisation and an appropriateness assessment; people who sign up after 8 January 2024 also wait 24 hours before trading. Coinbase says these FCA steps cannot be skipped.1 source
- In July 2024 the FCA fined CB Payments £3,503,546 for repeatedly breaching a requirement not to onboard new high-risk customers.1 source
Shown for your selected market. Other countries
Coinbase in Canada
- Coinbase Canada, Inc. states it is registered as a restricted dealer in all provinces and territories and with FINTRAC as a money services business (M22815925).1 source
- Canadian applicants answer questions on investing experience, risk tolerance and finances. Depending on the answers, they get full access (possibly with net purchase limits) or a net purchase limit of $1,000 over a rolling 12 months.1 source
Shown for your selected market. Other countries
Coinbase in Brazil
- Brazilian residents contract with Coinbase Brasil Sociedade Prestadora de Serviços de Ativos Virtuais Ltda., described as an intermediary under Central Bank Resolution 520/2025. The agreement was last updated on 30 October 2026.1 source
Shown for your selected market. Other countries
Documentary research from Coinbase’s own pages. We have not opened an account or tested the product.
How Coinbase stores your crypto
When you keep crypto in a Coinbase account, Coinbase holds the private keys for you. Coinbase says it keeps over 99% of customer assets in and moves funds in and out of hot wallets as customers deposit and withdraw, with distributed keys, withdrawal limits, anomaly detection and kill switches that can halt signing.1 source
It also says customer assets are held 1:1, remain the customer’s property and are not lent or used without your instruction, and that its records track customer holdings separately from company assets. As a publicly traded company in the S&P 500, Coinbase says an external auditor reviews its financials quarterly and that it files annual audited statements with the SEC. These are Coinbase’s own descriptions, not an independent audit of its custody.1 source
The documented facts behind this section (3)
- CustodyCoinbase says it keeps over 99% of customer assets in cold storage and moves funds in and out of hot wallets as customers deposit and withdraw. Transfers are protected by distributed keys, withdrawal limits, anomaly detection and kill switches that can halt signing.Source: How Coinbase protects customer assets (Coinbase blog, 4 Nov 2026)
- CustodyCoinbase says customer assets are held 1:1, remain the customer’s property and are not lent or used unless the customer instructs it, and that its records track customer holdings separately from company assets.Source: How Coinbase protects customer assets (Coinbase blog, 4 Nov 2026)
- CompanyCoinbase is a publicly traded US company in the S&P 500. It says its financials are reviewed quarterly by an external auditor and that it files annual audited financial statements with the SEC.Source: How Coinbase protects customer assets (Coinbase blog, 4 Nov 2026)
Is crypto on Coinbase insured?
Insurance is where most confusion starts, because Coinbase treats crypto and cash differently. Crypto held on Coinbase is not insured by the FDIC, NCUSIF or SIPC.1 source
| Crypto | US dollar balance | |
|---|---|---|
| Government deposit insurance | None: not FDIC, NCUSIF or SIPC | Pass-through cover up to $250,000 per depositor, subject to conditions |
| Coinbase crime insurance | Covers a portion of the crypto in its storage systems against theft | Not stated |
| Someone logs in with your credentials | Not covered by the crime insurance | Not stated |
These details come from Coinbase’s US disclosures. We have not confirmed the equivalent arrangements for the UK, Canada or Brazil.
The documented facts behind this section (2)
- Custody and insuranceCrypto held on Coinbase is not insured by the FDIC, NCUSIF or SIPC. Coinbase’s crime insurance covers a portion of the crypto in its storage systems against theft, but not losses from someone accessing your account with your credentials.Source: Coinbase insurance disclosures
- Custody and insuranceUS dollar balances are held in pooled custodial accounts at FDIC-insured banks or NCUSIF-insured credit unions, set up for pass-through insurance up to $250,000 per depositor, subject to conditions.Source: Coinbase insurance disclosures
How to lock down your Coinbase account
- 1PasswordThe first check when you sign in.
- 22-step verificationRequired on every account. Coinbase rates security keys highest.
- 3Trusted contactsPeople you name to approve account recovery.
- 4Address allowlistingSends only to saved addresses; a new one waits 48 hours.
Coinbase’s crime insurance excludes losses when someone accesses your account with your credentials, so this part is on you. 2-step verification is required; Coinbase recommends more than one method, rates two security keys as the highest security and lets you name trusted contacts to approve account recovery.2 sources
Address allowlisting limits crypto sends to addresses in your address book. A new address can receive sends only after 48 hours, and turning the feature off also takes 48 hours, unless you do it within 8 hours of turning it on.1 source
Account checklist
- Use a security key or passkey for 2-step verification, with a backup method
- Turn on address allowlisting if you send crypto to the same few addresses
- Use a unique password stored in a password manager
- Never share 2FA codes, passwords or a seed phrase with anyone, including “support”
- Reach Coinbase only through the app or help.coinbase.com, never a number from a search ad or message
The documented facts behind this section (2)
- Account security2-step verification is required to access a Coinbase account. Coinbase recommends more than one method, rating two security keys as the highest security, and lets you name trusted contacts to approve account recovery.Source: Set up your 2-step verification (Coinbase Help)
- Account securityAddress allowlisting limits crypto sends to addresses in your address book. A new address can receive sends only after 48 hours, and turning the feature off also takes 48 hours (unless done within 8 hours of turning it on).Source: Address book allowlist (Coinbase Help)
Scams and the 2025 data incident
On 15 May 2025 Coinbase disclosed that bribed overseas support agents had copied account data of a small subset of customers. It says no passwords, private keys or funds were exposed, and that it would reimburse customers tricked into sending funds to the attackers. Copied data like this can make a fake support call sound convincing.1 source
Coinbase Support will never1 source
- Ask for your password
- Ask for a 2-step verification code
- Ask for your seed phrase
- Ask you to move or “secure” your funds
- Ask you to install software or remotely access your device
Coinbase also says it does not sell insurance products. If someone asks for any of the above, hang up and email [email protected].1 source
The documented facts behind this section (2)
- Security incidentOn 15 May 2025 Coinbase disclosed that bribed overseas support agents copied account data of a small subset of customers. Coinbase states no passwords, private keys or funds were exposed, and that it would reimburse customers tricked into sending funds to the attackers.Source: Coinbase blog, 15 May 2025
- ScamsCoinbase says its support agents will never ask for your password, 2-step verification code or seed phrase, ask you to move or secure funds, install software or remotely access your device, and that it does not sell insurance products. If asked, hang up and email [email protected].Source: Technical support and impersonation scams (Coinbase Help)
Coinbase account vs a self-custody wallet
Searches for “is Coinbase Wallet safe” often mix up two different products. A Coinbase account is custodial; a wallet, such as the Base app, puts the keys and the responsibility with you.1 source
| Coinbase account | Self-custody wallet (e.g. Base app) | |
|---|---|---|
| Who holds the keys | Coinbase | You |
| Your backup | Account recovery if you forget your password | A 12- or 24-word recovery phrase |
| If the backup is lost | Coinbase can help you recover access | No one can recover the funds |
The documented facts behind this section (1)
- Coinbase account vs self-custody walletA Coinbase account is custodial: Coinbase manages the private keys, and you can recover access if you forget your password. A self-custody wallet (such as the Base app) gives you a 12- or 24-word recovery phrase; if you lose it, no one can recover the funds.Source: Exchanges and self-custody wallets (Coinbase Help)
How Coinbase compares with Kraken and Crypto.com
The three exchanges document their safeguards differently. This table only sets side by side what each one says on its own pages; it is not a ranking.
| Coinbase | Kraken | Crypto.com | |
|---|---|---|---|
| Cold storage | Over 99% of customer assets1 source | Uses cold storage and hot wallets; no share stated1 source | 100% of user crypto offline (US App page)1 source |
| Two-factor authentication | Required to access the account; security keys rated highest1 source | Passkeys (recommended) or an authenticator app2 sources | 6-digit codes required for withdrawals and whitelisting1 source |
| New withdrawal addresses | Optional allowlist: new addresses wait 48 hours1 source | Email confirmation; optional Global Settings Lock2 sources | Optional 24-hour lock on new whitelisted addresses1 source |
| Reserves and accounts | Audited financial statements filed annually with the SEC1 source | Proof-of-reserves check by an accounting firm (post of Nov 2022)1 source | Proof-of-reserves report by Mazars (Dec 2022)1 source |
| Support never asks for | Password, 2-step codes, seed phrase1 source | Password, 2FA codes, seed words, Master Key1 source | Login details, private keys, MFA codes, recovery phrase1 source |
Is Coinbase regulated?
Coinbase operates through a different local company in each market. A licence or registration covers specific activities; it is not a guarantee against loss.
United States Your selected market
- Coinbase publishes its state licences, including New York, on its licences page. A licence covers specific activities; it does not mean every product is offered in every state.1 source
United Kingdom Your selected market
- UK customers contract with CB Payments Ltd, authorised by the FCA for e-money and registered under the Money Laundering Regulations for specific cryptoasset activities (register number 900635). The UK user agreement was last updated on 16 October 2026.1 source
- To buy or sell, UK users complete a client categorisation and an appropriateness assessment; people who sign up after 8 January 2024 also wait 24 hours before trading. Coinbase says these FCA steps cannot be skipped.1 source
- In July 2024 the FCA fined CB Payments £3,503,546 for repeatedly breaching a requirement not to onboard new high-risk customers.1 source
Canada Your selected market
- Coinbase Canada, Inc. states it is registered as a restricted dealer in all provinces and territories and with FINTRAC as a money services business (M22815925).1 source
- Canadian applicants answer questions on investing experience, risk tolerance and finances. Depending on the answers, they get full access (possibly with net purchase limits) or a net purchase limit of $1,000 over a rolling 12 months.1 source
Brazil Your selected market
- Brazilian residents contract with Coinbase Brasil Sociedade Prestadora de Serviços de Ativos Virtuais Ltda., described as an intermediary under Central Bank Resolution 520/2025. The agreement was last updated on 30 October 2026.1 source
Is Coinbase safe?
Coinbase documents strong protections: over 99% of customer crypto in cold storage, assets held 1:1 and not lent out, mandatory 2-step verification and audited financial statements filed with the SEC. But crypto on Coinbase is not FDIC or SIPC insured, you rely on Coinbase as custodian, and its insurance does not cover losses through your own login. Protecting your own account matters as much as Coinbase’s controls.3 sources
Is Coinbase legit?
Coinbase is a publicly traded US company in the S&P 500 that files annual audited financial statements with the SEC, and it serves customers through registered or licensed local companies in the US, UK, Canada and Brazil. Being legitimate does not make it risk-free; see the insurance and scam sections above.5 sources
Is my crypto insured on Coinbase?
Not by the FDIC, NCUSIF or SIPC. Coinbase’s crime insurance covers a portion of crypto in its storage against theft, but not losses when someone accesses your account with your credentials. In the US, cash balances are held at insured banks with pass-through cover up to $250,000, subject to conditions.1 source
Has Coinbase been hacked?
In May 2025 Coinbase disclosed that bribed overseas support agents copied account data of a small subset of customers. Coinbase says no passwords, private keys or funds were exposed, and that it would reimburse customers tricked into sending funds to the attackers.1 source
Is it safe to give Coinbase my ID or SSN?
Exchanges like Coinbase are required to verify identity (KYC) before you can trade. The 2025 incident shows that customer data held by any company can be exposed, so treat unexpected calls or messages that quote your details with suspicion, and never share passwords, 2FA codes or a seed phrase.2 sources
Is Coinbase Wallet the same as Coinbase?
No. A Coinbase account is custodial: Coinbase manages the keys and can help you recover access. A self-custody wallet such as the Base app gives you a recovery phrase; if you lose it, no one, including Coinbase, can recover the funds.1 source
Read more: Coinbase account vs a self-custody walletCopy link
Does Coinbase have a seed phrase?
A Coinbase account does not. It is custodial, so Coinbase manages the private keys and you can recover access if you forget your password. A self-custody wallet such as the Base app gives you a 12- or 24-word recovery phrase, and if you lose it no one can recover the funds. Coinbase also says its support agents will never ask for a seed phrase.2 sources
Read more: Coinbase account vs a self-custody walletCopy link
Is it safe to keep crypto on Coinbase?
Coinbase says it keeps over 99% of customer assets in cold storage and holds them 1:1 without lending them out. Crypto on Coinbase is not covered by FDIC, NCUSIF or SIPC insurance. These are Coinbase’s own statements, not an independent audit. Holding the keys yourself in a self-custody wallet removes the exchange from the picture and puts the backup in your hands instead.2 sources
Sources
Every platform fact on this page comes from these official pages. Each “sources” marker on this page links to pages from this list.
coinbase.com
help.coinbase.com
fca.org.uk
kraken.com
support.kraken.com
help.crypto.com
blog.kraken.com
How we research · Educational content, not investment advice. Cryptoassets are high risk and you could lose all the money you invest. Rules and availability vary by country.
