Is Coinbase Safe? Custody, Insurance, the 2025 Data Breach and Account Protection

Coinbase is a Nasdaq-listed, US-regulated public company that keeps the large majority of customer crypto in offline cold storage and holds customer US dollars at FDIC-insured banks, so the platform is structurally safer than many unregulated exchanges. But crypto balances are not government-insured, and on 15 May 2025 Coinbase disclosed that criminals had bribed overseas support staff to copy customer data, an incident it estimated could cost between $180 million and $400 million. For most users the real question is how you secure your own login and where you hold coins you plan to keep long term.

Is Coinbase safe to use?

Coinbase is a public company listed on the Nasdaq under the ticker COIN, and its US business holds money transmitter licences in the states where required plus a New York BitLicense. Its annual report says it seeks to hold no more than 2% of assets under custody in internet-connected hot wallets, with the rest in cold storage. That structure reduces theft risk, but it does not make Coinbase risk-free: your crypto is not government-insured, and account security still depends on you.

Coinbase Global, Inc. files audited annual reports (Form 10-K) with the US Securities and Exchange Commission, which means its finances and risk factors are public. Its US entity operates as a licensed money transmitter in the states and jurisdictions that require it, including a BitLicense from the New York Department of Financial Services and a Virtual Currency Business License from Louisiana, according to its 10-K. Overseas, Coinbase runs through locally licensed entities, including a Luxembourg entity that must keep client assets in segregated cold storage under MiCA.

Regulation and disclosure are not the same as deposit protection. Read our explainer on keeping crypto on an exchange and the full Coinbase review for the broader picture.

What happened in the 2025 Coinbase data breach?

On 15 May 2025 Coinbase filed a Form 8-K with the SEC saying that, after receiving an email demand from an unknown actor on 11 May 2025, it found criminals had paid multiple contractors and employees in overseas support roles to copy customer data from internal systems. Coinbase said no passwords, private keys or customer funds were accessed, and it estimated remediation costs and voluntary customer reimbursements at roughly $180 million to $400 million.

According to the 8-K, the stolen data included names, addresses, phone numbers and email addresses, masked Social Security numbers (last four digits only), masked bank account numbers, government-ID images such as driver’s licences and passports, account balance snapshots and transaction history, and limited corporate data. Coinbase wrote that at no time were any of the targeted contractors or employees able to access customer funds.

CEO Brian Armstrong said the demand was for $20 million in bitcoin, which Coinbase refused to pay, and the company instead announced a $20 million reward fund for information leading to the attackers’ arrest and conviction. Coinbase also said it would voluntarily reimburse eligible retail customers who sent funds to the attacker as a direct result of the incident.

The breach was a theft of identity data used for social engineering, not a hack of Coinbase’s wallets. Attackers used the records to impersonate Coinbase support and trick people into sending funds themselves, which is why the company’s advice and ours centres on recognising the Coinbase withdrawal-code text scam.

Is my crypto insured if Coinbase is hacked or fails?

No. In its own 10-K, Coinbase writes that crypto assets are not insured or guaranteed by any government or government agency. Only US dollar balances get pass-through FDIC insurance, because Coinbase holds them at FDIC-insured banks, up to the standard $250,000 per depositor, per bank, per ownership category. Coinbase also carries a commercial crime insurance policy, but it does not cover losses caused by your own compromised login.

Here is what is and is not covered.

The FDIC limit applies to deposits, not to crypto or other investments. If you want to know how exchanges prove they hold the assets they claim, see proof of reserves explained.

Where does Coinbase keep customer crypto?

Coinbase’s 10-K says it seeks to hold no more than 2% of assets under custody in hot wallets at any given time, which means roughly 98% or more sits in cold storage: private keys kept offline and disconnected from the internet. Its custodian entities, including Coinbase Custody Trust Company in the US and a Luxembourg entity required to hold client assets in segregated cold storage under MiCA, keep crypto in dedicated addresses.

Cold storage protects against the kind of online theft that has hit some exchanges, because the keys needed to move funds are not reachable from the network. It is an operational safeguard, not a financial guarantee: the 10-K notes that customer assets on the platform are substantially more than our corporate assets and available insurance. For context on the opposite failure mode, see what happens when a hot wallet is attacked.

Could my crypto be lost if Coinbase goes bankrupt?

Coinbase’s 10-K contains a risk-factor warning that, because custodially held crypto assets may be considered the property of a bankruptcy estate, in a bankruptcy the crypto it holds for customers could be subject to bankruptcy proceedings and customers could be treated as general unsecured creditors. Coinbase says it does not believe this would happen and structures its customer agreements against it, but courts have not tested custodied crypto, and crypto has no equivalent of the SIPC protection that covers brokerage cash and securities.

Coinbase also states in the same filing that customer assets held in its US entities are not property of Coinbase and not subject to claims of our general creditors. That is a meaningful protection, but the bankruptcy caveat remains in its risk factors because the area is legally new. Failed platforms like FTX showed what general unsecured creditor means in practice: see the FTX collapse and repayments explained.

This is the main argument for self-custody of coins you intend to hold long term. Read how to move crypto from an exchange to a wallet and how to store a seed phrase safely.

How much does Coinbase charge? What do fees cost on $1,000?

Coinbase has two fee structures. Coinbase Advanced charges maker and taker fees that vary by 30-day trading volume; from 16 September 2026, US spot trading at the $10,000-and-over tier cost 0.50% maker and 0.90% taker, while the EU and UK paid 0.25% and 0.50% and several international markets paid 0.09% and 0.10%. The simple buy and sell product instead includes a spread in the quoted price, which is usually more expensive for small amounts.

On an illustrative $1,000 US spot market order at the 0.90% taker rate, the fee is $9; the same order as a maker at 0.50% costs $5. Lower 30-day volume tiers carry higher rates, so check your current tier in account settings before a large order. These are trading fees only and do not include any spread shown on the simple buy and sell button.

What should users do now?

If you have a Coinbase account, concentrate on your own login rather than the company’s solvency. Turn on two-factor authentication using an authenticator app or a hardware security key rather than SMS, use a unique password, and treat any call, text or email claiming to be Coinbase support as suspicious. Move coins you plan to hold long term to a wallet you control.

1. Enable app-based or hardware-key two-factor authentication in your Coinbase security settings.
2. Set a unique password stored in a password manager, and never reuse it elsewhere.
3. Assume contact from Coinbase support is a scam until you verify it inside the official app or website; Coinbase will never ask for your password, two-factor code or seed phrase.
4. Check your account’s withdrawal settings and be alert to withdrawal-code text scams.
5. For coins you do not need to trade, consider moving them to self-custody.
6. Before a large trade, check your 30-day volume tier so you know which fee rate applies.

Crypto assets are volatile and this is not financial advice. For help choosing between custody options, start with the wallet hub and the exchange hub.