Whether Coinbase is safe enough for you depends on what you hold there and what you need protected. As of 14 October 2026 the evidence is: state money transmitter licences across the US, a New York virtual currency licence, an EU MiCA licence from Luxembourg, UK and Singapore permissions; no published proof of reserves, only audited financial statements as a listed company; and no confirmed theft of client crypto from Coinbase’s own wallets in the sources checked.
The record also includes a 2025 insider data theft that cost Coinbase $307 million and regulatory fines in the US, Netherlands, UK and Ireland. Your US dollar cash may get FDIC pass-through cover if the bank holding it fails. Your crypto gets no FDIC cover at all.
If you are asking “is Coinbase safe?”, you probably already have money on it or are about to send some. Most answers tell you it is a big, public, regulated company and leave it there. Several also repeat insurance and FDIC claims that Coinbase’s own documents do not support. This guide shows you the evidence instead: licences by region, reserves, custody terms, what insurance and the FDIC actually cover, every incident and enforcement action found, and the risk that stays with you.
Is Coinbase safe? The short answer
No exchange can be called safe outright, Coinbase included. What you can check is the evidence. As of 14 October 2026, Coinbase is licensed or registered in the US, EU, UK, Singapore and India, and its parent, Coinbase Global, Inc., is a public company that files audited accounts with the SEC. In the sources checked for this article, no attacker has taken client crypto from Coinbase’s own hot or cold wallets. The weak points are elsewhere. In 2025, bribed support contractors leaked data on 69,461 customers, which fed impersonation scams. Coinbase has paid regulators for anti-money-laundering failures in three countries. And its user agreement says plainly that your crypto is not covered by the FDIC or the SIPC.
This guide uses the same six checks this site applies to every exchange safety review, matching the methodology criteria of track record, transparency, security practices and jurisdiction coverage:
- Licences by region
- Proof of reserves, or what stands in for it
- Custody terms, labelled as company claims
- Insurance and the FDIC, and what each really covers
- Incident and enforcement history, dated and sourced
- The risk that remains for you
Is Coinbase regulated? Licences by region
Yes, but through different companies in different places. Coinbase’s licences page lists permissions held by Coinbase, Inc. and two US sister companies; other regions are served by local entities.
| Region | Coinbase entity | Regulator and permission | Source |
|---|---|---|---|
| United States | Coinbase, Inc. | State money transmitter licences in dozens of states plus Washington DC and Puerto Rico (NMLS 1163082). Coinbase notes its Indiana, Louisiana, Tennessee and Virginia money transmitter licences do not cover virtual currency. | Coinbase licences page |
| United States (New York) | Coinbase, Inc. | NYDFS Virtual Currency Business Activity licence 122466 and money transmitter licence MT 103755 | Coinbase licences page |
| United States | Coinbase Custody Trust Company, LLC | Limited purpose trust company chartered by the New York State Department of Financial Services (NMLS 2455008) | Coinbase licences page |
| United States | Coinbase Derivatives, LLC | Designated contract market registered with the CFTC | Coinbase licences page |
| European Union | Coinbase (Luxembourg hub) | MiCA crypto-asset service provider licence from the CSSF, announced 20 June 2025, covering all 27 member states | Luxembourg for Finance, 20 June 2025 |
| United Kingdom | CB Payments Ltd | FCA cryptoasset (VASP) registration, reported 3 February 2025, on top of its existing e-money business | CoinDesk, 3 February 2025 |
| Singapore | Coinbase’s Singapore entity | MAS Major Payment Institution licence for digital payment token services, granted October 2023 | The Block, 2 October 2023 |
| India | Coinbase | FIU-IND reporting entity registration, announced 11 March 2025 | Finance Magnates, 11 March 2025 |
| UAE (Abu Dhabi) | Coinbase | ADGM FSRA Financial Services Permission for arranging deals and custody, announced 11 August 2026, aimed at tokenised securities for eligible non-US investors. Not described as a retail exchange licence, and it does not extend to Dubai. | LiquidityFinder, August 2026 |
US entries checked 14 October 2026 on Coinbase’s licences page. Other entries are as reported on the dates shown; confirm them on the CSSF, FCA, MAS, FIU-IND and FSRA registers before relying on them.
What regulation does and does not mean
Several of these permissions are anti-money-laundering registrations, which let a regulator supervise and fine the company. None of them guarantees your balance. Coinbase’s own state disclosures say account balances “are not subject to Federal Deposit Insurance Corporation or Securities Investor Protection Corporation protections”. The licence record also includes failures: the enforcement table below shows fines from regulators in New York, the Netherlands, the UK and Ireland. For the wider picture of US crypto rules this year, see the October 2026 regulation roundup.
Is Coinbase FDIC insured? The myths and the facts
Coinbase is not a bank and is not FDIC insured. Your US dollar cash on Coinbase may be covered by FDIC pass-through insurance up to $250,000, but only against the failure of the bank that holds it. Your crypto, including stablecoins, has no FDIC cover. Here is where each part of that answer comes from.
What Coinbase’s user agreement says
The US Coinbase User Agreement (between you and Coinbase, Inc., last updated 22 July 2026) says:
- “Coinbase is not an FDIC-insured bank or NCUSIF-insured credit union.”
- US dollar balances are held in pooled custodial accounts at one or more FDIC- or NCUSIF-insured institutions, and “Availability of pass-through insurance is contingent upon factors including Coinbase having correct information”.
- “Coinbase owns the interest or other earnings on these investments”, and it “will not use customer funds for its operating expenses or any other corporate purposes”.
- “Digital Assets are not subject to protections or insurance provided by the Federal Deposit Insurance Corporation” or the Securities Investor Protection Corporation.
Coinbase’s help article on insurance adds three limits. Pass-through cover is “currently $250,000 per depositor”. It applies only “to the extent U.S. customer U.S. Dollar funds are held as cash”, so any part of the pool invested elsewhere is outside it. And it is “only applicable to U.S.-based customers of Coinbase, Inc.” The bank list on that page is labelled “as of May, 2025”. In its 10-Q for the quarter to 30 June 2026, Coinbase reported $4.30 billion in customer custodial funds.
What the FDIC says
The FDIC’s 2022 advisory on crypto companies sets out the rules that apply here. “The FDIC only pays deposit insurance after an insured bank fails.” And “FDIC insurance does not protect a non-bank’s customers against the default, insolvency, or bankruptcy of any non-bank entity”. Its July 2022 fact sheet adds: “The FDIC does not insure assets issued by non-bank entities, such as crypto companies.”
| Common claim | What the documents show |
|---|---|
| “Coinbase is FDIC insured” | False. Coinbase states it is not an FDIC-insured bank. |
| “Your USD on Coinbase is FDIC insured up to $250,000” | Partly true. Pass-through cover may apply to cash held at partner banks, for US customers of Coinbase, Inc., if Coinbase’s records are correct. It protects you only if that partner bank fails. |
| “FDIC covers you if Coinbase goes bust” | False. FDIC insurance does not protect against the insolvency of a non-bank such as Coinbase. |
| “FDIC covers you if your account is hacked” | False. Deposit insurance pays only when an insured bank fails, not for theft or account takeover. |
| “Your crypto is FDIC insured” | False. The user agreement says digital assets are not covered by the FDIC or SIPC. |
| “USDC is the same as dollars” | Not for insurance purposes. A stablecoin is a crypto asset, so the digital asset disclaimer applies. See how stablecoins keep their peg and where that can fail. |
Is Coinbase insured? What the crime policy and Account Protection cover
Coinbase has insurance, but not insurance on your account. Its help article says it holds crime insurance that “protects a portion of digital assets held across our storage systems against losses from theft”, including cybersecurity breaches. It gives no dollar amount and warns that “total losses may exceed insurance recoveries so your funds may still be lost”. The policy “does not cover any losses resulting from unauthorized access to your personal Coinbase account(s)” when your own credentials were lost or stolen.
Some ranking pages state a specific crime insurance figure and a cold storage percentage. Neither appears on Coinbase’s current security page, its insurance article or its custody article, checked 14 October 2026.
Separately, Coinbase One members may be enrolled in Account Protection. Coinbase calls it “a limited warranty” and says it “is not insurance and does not provide reimbursements for many types of losses”. To claim, the transfer must have been signed with a security key or passkey, you must have completed photo ID verification, the account must be over 30 days old, and you must file within 45 days with reports to your local police and the FBI’s Internet Crime Complaint Center. It excludes transfers you authorised yourself, including payments to scammers, and Coinbase Wallet and other self-custody wallets. Your per-incident limit is shown on your Coinbase One page, with a lifetime cap of twice that amount.
Does Coinbase have proof of reserves?
Not in the cryptographic sense. Coinbase does not publish a Merkle-tree proof of reserves that lets you check your own balance is included. What it offers instead:
| Item | What is published |
|---|---|
| Merkle-tree proof of reserves | None found on Coinbase’s security or custody pages (checked 14 October 2026). An independent proof-of-reserves tracker (Spark, August 2026) lists Coinbase’s method as “N/A” and classes it as a “regulatory proxy”. |
| Company statement | “Coinbase always holds customer assets 1:1” and is “audited annually by an independent third-party as required by law” |
| Public filings | Quarterly 10-Q and annual 10-K reports to the SEC, as a Nasdaq-listed company. The 30 June 2026 10-Q reports $4.30 billion in customer custodial (fiat) funds. |
| Who audits | Deloitte audits the financial statements, per the Spark tracker |
The trade-off is worth understanding. A financial statement audit is broad and covers liabilities, which a point-in-time Merkle snapshot does not. But it is not a check designed to prove that specific coins match specific customer balances, and you cannot verify your own account against it.
Custody: what Coinbase claims and what the terms say
These points come from Coinbase’s own documents, not an independent check.
- Cold storage: Coinbase says it stores “a vast majority of assets offline in secure, guarded cold storage facilities”. It gives no percentage.
- No lending: “We do not lend or take any action with your assets, unless you specifically instruct us to.”
- Security features: auto-enrolled two-factor authentication with security key support, multi-approval withdrawals in Coinbase Vault, and a bug bounty on HackerOne, per its security page.
Is my crypto safe on Coinbase if the company fails?
The user agreement gives you strong words on paper. Section 2.7.1 says “Title to Supported Digital Assets shall at all times remain with you and shall not transfer to Coinbase”. It describes them as held for customers and not Coinbase’s property, says they are not subject to claims of Coinbase’s creditors, and says Coinbase will not lend, pledge or hypothecate them (with listed exceptions). The same section also says “you shall bear all risk of loss”. Coinbase may hold your coins in shared blockchain addresses, and it keeps the private keys. No Coinbase insolvency has tested these terms in court, so treat them as Coinbase’s commitment, not a guarantee.
Has Coinbase been hacked?
Coinbase’s wallets have not been drained in any incident found for this article. Its people and its customers’ accounts have been targeted repeatedly, and the 2025 incident was serious.
| Date | What happened | Client funds | Source |
|---|---|---|---|
| 2021 | A flaw in SMS account recovery let attackers into at least 6,000 customer accounts | Taken from individual accounts; Coinbase reimbursed affected customers, as reported | NordVPN and Aura reviews of the incident |
| February 2023 | SMS and voice phishing against a Coinbase employee | No customer funds taken, as reported | NordVPN and Aura reviews of the incident |
| 26 December 2024 to May 2025 | Criminals bribed overseas support contractors to copy customer data: names, addresses, phone numbers, emails, last four SSN digits, masked bank numbers, ID images, balances and transaction history. They demanded a $20 million ransom, which Coinbase refused, offering a $20 million reward instead. 69,461 customers were affected. | Coinbase says passwords, 2FA codes, private keys and its hot and cold wallets were not accessed. Customers tricked into sending funds to the scammers were offered voluntary reimbursement. Coinbase booked $307 million in related expenses in Q2 2025. | Coinbase 8-K, 15 May 2025; Coinbase blog, 15 May 2025; Maine AG filing via Decrypt, 21 May 2025; Q2 2025 shareholder letter |
| 14 July 2026 | About 50 minutes of service disruption to transfers, card transactions and onchain services, caused by a configuration change. An outage, not a breach. | “At no point were customer funds at risk,” per Coinbase | Coinbase postmortem, 21 July 2026 |
| 29 September 2026 | BlockTower founder Ari Paul claimed on X that his firm lost $25 million on Coinbase “a few years ago” through undisclosed hacks, and that other firms lost more | Unverified claim. No evidence published, citing ongoing lawsuits; no Coinbase response found. | The Cryptonomist, 29 September 2026 |
Checked 14 October 2026.
The 2025 data theft matters more than its “no funds accessed” line suggests. Leaked names, balances and ID images let scammers pose convincingly as Coinbase. In December 2025 an American Arbitration Association arbitrator ordered Coinbase to pay $618,000 to a customer whose account was taken over by social engineering in January 2024; the award says Coinbase knew of a breach at its support vendor TaskUs in January 2025 but customers were not told until May (InvestmentNews, 16 December 2025). Class actions over the breach were filed from May 2025, and no settlement had been announced in the sources checked.
Does Coinbase call you? Fake support scams
This is the main way people lose money “on Coinbase” without Coinbase being hacked. On 23 September 2026 a Brooklyn court sentenced Ronald Spektor to four to 12 years for stealing about $15.9 million from roughly 100 Coinbase users. He posed as Coinbase support, warned victims a hacker was after their assets, and had them move crypto to a wallet he controlled (The Block, 24 September 2026).
Coinbase says it will not contact you first for passwords or codes and will not ask you to move assets immediately for security reasons. Its support team “will never ask for your password, 2FA codes, or for you to install any additional software”. If you need to call, use only the phone numbers listed in Coinbase’s Help Center, never a number from a search ad, text or email.
Coinbase enforcement history
Coinbase has faced at least seven regulatory or legal actions since 2021. None found that client crypto was missing. Most concern anti-money-laundering controls and registration.
| Date | Regulator | What it was about | Outcome |
|---|---|---|---|
| 19 March 2021 | CFTC (US) | Inaccurate trade reporting on its GDAX platform from 2015 to 2018, and wash trades by a former employee | $6.5 million civil penalty |
| 4 January 2023 | NYDFS (New York) | Weak customer due diligence and a backlog of “over 100,000 unreviewed transaction monitoring alerts” by late 2021 | $50 million penalty plus $50 million in required compliance spending |
| 26 January 2023 | De Nederlandsche Bank (Netherlands) | Offering crypto services without the required registration from November 2020 to August 2022 | €3,325,000 fine |
| June 2023 to 27 February 2025 | SEC (US) | Civil lawsuit against Coinbase, Inc. and Coinbase Global, Inc. | Dismissed by joint stipulation on 27 February 2025. The SEC said this was “not on any assessment of the merits”. |
| 25 July 2024 | FCA (UK) | CB Payments Ltd onboarded 13,416 high-risk customers despite a requirement barring it from doing so | Fine of just over £3.5 million |
| 6 November 2025 | Central Bank of Ireland | Coinbase Europe Limited failed to properly monitor 30,442,437 transactions worth over €176 billion, about 31% of the total, between April 2021 and March 2025 | €21,464,734 fine, confirmed by the High Court on 12 January 2026 |
| 21 April 2026 | New York Attorney General | Lawsuit alleging Coinbase Financial Markets, Inc. runs unlicensed prediction markets that amount to illegal gambling in New York | Pending; seeks forfeiture, restitution and fines |
Checked 14 October 2026 against the CFTC, NYDFS, SEC and Central Bank of Ireland releases and the New York Attorney General’s release; the Dutch and UK entries are as reported by Kitco and The Block.
The Irish case is the one to read if you want to judge Coinbase’s controls. It ran for almost four years, after the 2023 New York settlement over the same kind of failure.
Is it safe to leave money in Coinbase?
It depends on what kind of money and how much. US dollar cash has pass-through FDIC cover against a partner bank failure, within the limits above. Crypto has no government cover, and the crime policy does not cover account takeovers. Every balance also depends on Coinbase’s terms.
Section 6.10 of the user agreement lets Coinbase “suspend, restrict, or terminate your access to any or all of the Coinbase Services” “with immediate effect for any reason at its sole discretion”. If that happens, the agreement says you can still transfer assets for ninety days after deactivation, unless the law or a court order prevents it. That is the usual reason people find they cannot withdraw: an account restriction, not a missing balance.
Where is the safest place to store crypto?
There is no safest place, only a choice of risks. On Coinbase you carry counterparty risk: you rely on its solvency, its controls and its decisions. In a self-custody wallet, including Coinbase’s separate self-custody wallet app, you carry the key risk yourself; lose the recovery words and no one can restore your funds. Read how to store a seed phrase before moving anything you cannot afford to lose.
How to reduce the risk you control
- Use a hardware security key or passkey. Coinbase says “Hardware security keys are the most secure, followed by authenticator apps”, and SMS is the weakest. A key or passkey is also a condition for Account Protection claims.
- Use Coinbase Vault for larger holdings, which adds multi-approval withdrawals.
- Assume any unexpected “Coinbase” call, text or email is a scam, especially one that knows your details or urges you to move funds.
- Keep only what you are actively using on the exchange, and know that your USD and your crypto are protected in different ways.
- If your account is taken over, contact Coinbase through the Help Center and file police and IC3 reports at once; Account Protection claims must be made within 45 days.
What this means for you
As of 14 October 2026, Coinbase is one of the most heavily licensed and most publicly scrutinised crypto exchanges, and no incident found for this article took client crypto from its own wallets. Against that sit a 2025 insider data theft that exposed 69,461 customers and fed impersonation fraud, anti-money-laundering fines in three countries, no cryptographic proof of reserves, and no insurance or government cover on your crypto. The FDIC point is the one most often misstated: it may protect your US dollar cash if a partner bank fails, and nothing else. What remains is counterparty risk plus account takeover risk. Size what you keep on Coinbase to match how much of both you are willing to carry.
The same six-point evidence check is applied to other platforms in the Exchanges section, starting with Is Kraken Safe?
