Coinbase is a US cryptocurrency company whose app and website let you buy, hold and send coins from an account it runs. It is reviewed here on the same five criteria as the wallets in this section, as a point of reference for anyone comparing an account like this with a wallet where you hold the keys yourself. It is not a recommendation, and its trading features are outside the scope of this review.

The review turns on one fact: Coinbase holds the keys. The coins in your account sit on blockchain addresses that Coinbase controls, and you can move them only by asking Coinbase to send them. Coinbase also knows exactly who you are, because an account cannot be used without a government ID and a selfie.

Coinbase also makes a separate app, the Base app, formerly called Coinbase Wallet, in which you hold the keys yourself. That app is a different product and is not covered by this review.

Who Holds the Keys

Coinbase’s US user agreement calls the coins in your account “custodial assets held by Coinbase for your benefit”. Coinbase stores the private keys, partly online and partly offline, and says that “Coinbase shall retain control over electronic private keys” for as long as you keep coins with it. Its annual report says it aims to keep no more than 2% of the assets it holds in online (hot) wallets. There is no seed phrase and no key for you to back up, and the account cannot be restored in any other wallet. This is the opposite of self-custody.

In the US the coins are not kept separately for each customer. Coinbase, Inc. may hold them on shared addresses, often called omnibus addresses, and keeps track of who owns what in its own ledger. You cannot choose which coins a withdrawal spends or from which address it leaves.

On paper, the coins stay yours. The US agreement says title remains with you, that the assets are “not property of Coinbase” and not subject to claims of its creditors, and treats them as financial assets under Article 8 of the Uniform Commercial Code. The annual report Coinbase files with the SEC adds a warning: in a bankruptcy, the crypto it holds for customers could become part of the bankruptcy estate, and customers “could be treated as our general unsecured creditors”.

Access depends on Coinbase. The agreement allows it to “suspend, restrict, or terminate” your access, or close your account, “for any reason at its sole discretion”, and says it “is under no obligation to disclose the details of its decision”. After an account is closed, you have 90 days to move your coins and cash out, unless the transfer is prohibited by law, including sanctions, or by a subpoena or court order. Coinbase’s help pages say a restricted account may be unable to send crypto while it is under review, and completing the requested checks does not guarantee that the restriction will be lifted.

The upside of this model is recovery. If you lose your password, email or 2-step verification device, you can get back in by uploading your ID, or with the approval of trusted contacts you named in advance. The ID route takes up to 24 hours, and sends may stay blocked for another 24 hours. The account has no multisig: the separate Coinbase Vault feature can require other people to approve withdrawals, but that rule is enforced by Coinbase, not by splitting the keys.

What Coinbase Knows About You

Identity verification, known as KYC, is required when you open an account and again from time to time, and the account has limited functions until it is done. You photograph an ID document and take a selfie, which Coinbase compares with the document. The privacy policy lists what Coinbase may collect: your name, address, date of birth, nationality, phone number and email; your ID document, Social Security or other taxpayer number, proof of address, employment and salary details, and your spouse’s name and tax number; biometric data from your selfie; your bank and card numbers; and every transaction you make. Biometric data is kept for as long as financial regulations require.

Because Coinbase runs the account, it sees every balance and every transfer you make. Your own node, Tor and coin control change none of this. When you send coins to an outside address, the transaction is public on the blockchain like any other and leaves from an address Coinbase controls, and Coinbase keeps the record that ties it to your name. Sends to another Coinbase user by email, phone number or username stay off the blockchain, but Coinbase records both sides. Under the Travel Rule, a regulation in several countries, Coinbase may collect details about the other side of a transfer and pass your details to the exchange or service that receives it.

The privacy policy also says Coinbase shares conversion data, including your IP address, with advertisers such as Meta and AppLovin so they can build ad audiences. The App Store listing says device identifiers may be used to track you across apps and websites owned by other companies. On the website and in the app you can refuse advertising and analytics cookies, but device information, your IP address and crash and diagnostic data are collected automatically, so the telemetry is always on.

Coinbase publishes a yearly transparency report. From October 2024 to September 2025 it received 12,716 requests from government agencies and law enforcement, about 53% of them from outside the US. Coinbase says it may hand over your name, a recently used IP address and payment information, that it reviews each request and may narrow or challenge it, and that no government has direct access to its systems. The figures count requests received, not how many were answered.

Security and Transparency

The Coinbase apps and the systems behind them are closed source; the company’s public GitHub repositories hold developer tools and libraries, not the consumer app. Coinbase names SOC 1 and SOC 2 Type 2 reports for Coinbase Custody and Coinbase Prime, its services for institutions, and a SOC 2 Type 1 report for its staking services by Deloitte, but none of these reports is public, and none is named for the consumer app. No independent security audit of the service you sign in to is published. Deloitte, Coinbase’s financial auditor since 2020, checks balances on public blockchains as part of the yearly financial audit and, on a sample, that Coinbase controls the keys to its cold storage; that is an accounting check, not a review of the app’s security.

Coinbase has run a bug bounty on HackerOne since March 2014. It pays up to $1,000,000 for unauthorized access to Coinbase’s hot or cold wallets or private keys, and up to $6,000 for exposing personal data of many users or bypassing identity checks.

For the account itself, Coinbase recommends a security key or a passkey as the 2-step verification method, and the mobile app can require a PIN or Face ID. Coinbase asks for a second factor on certain larger sends, but not on routine ones.

The 2025 Data Theft Incident

Coinbase’s incident history includes one large leak of customer data. On 11 May 2025 Coinbase received an email demanding $20 million in exchange for not publishing customer data. The attacker had paid support contractors and employees working outside the US to copy data from Coinbase’s internal support tools, covering less than 1% of Coinbase’s monthly transacting users. The data included names, addresses, phone numbers and emails, the last four digits of Social Security numbers, masked bank account numbers, images of ID documents such as passports and driver’s licenses, balance snapshots and transaction histories. The goal was a list of people the attackers could call while pretending to be Coinbase.

Coinbase said no passwords, 2-step verification codes or private keys were taken and no one could move customer funds. Coinbase had already detected the insiders’ access and fired them in the preceding months, before the extortion email arrived. It refused to pay, emailed affected customers on 15 May 2025 and offered a $20 million reward for information leading to the attackers’ conviction. It said it would reimburse retail customers who had been tricked into sending coins to the attackers. In its next annual report Coinbase said it paid $311.2 million in 2025 in reimbursements and legal costs connected to the theft.

The incident shows the trade-off of an account tied to your identity: the attackers wanted a list of customers to deceive, and images of the ID documents Coinbase collects were among the data taken.

Ownership and Jurisdiction

In the US your agreement is with Coinbase, Inc., and it is governed by California law. Coinbase, Inc. was founded in 2012 and has belonged since 2014 to Coinbase Global, Inc., whose shares trade on Nasdaq. Coinbase Global has been incorporated in Texas since December 2025. As a listed company it files reports with the SEC, including a filing within days of the 2025 extortion email. In the EEA your personal data is controlled by Coinbase Ireland Limited, Coinbase Europe Limited and Coinbase Germany GmbH and can be transferred to Coinbase, Inc. in the US; other countries have their own Coinbase companies and terms.

Apps and Networks

Coinbase works in a web browser and in apps for Android and iPhone. It holds coins on Bitcoin, Ethereum, Solana, Base, Polygon, Arbitrum, Optimism, Avalanche, BNB Chain, Litecoin, Bitcoin Cash, Dogecoin, XRP, Cardano and Zcash, among many others, and sends and receives Bitcoin over Lightning by invoice. Some assets can move on more than one network, and you have to pick the same network as the other side: Coinbase says it cannot recover coins sent on the wrong one. Multi-network sends are not available in New York, and Lightning is not available in New York or Canada.

Price

An account is free, and Coinbase charges nothing to hold coins or to send them to another Coinbase user. A send to an outside address costs Coinbase’s estimate of the network fee; because Coinbase batches transactions, the total its users pay can be more than the fee it actually pays. A Lightning send adds a 0.2% processing fee. Buying, selling and converting include a Coinbase fee and a spread, both shown on the preview screen before you confirm. Fees differ by region.

Pros and Cons

A lost password or 2-step verification device does not cost you your coins: an ID upload or trusted contacts restore access
Free to hold coins and to send them to other Coinbase users
Covers Bitcoin with Lightning, Ethereum and its main layer-2 networks, Solana and other large networks in one account
HackerOne bug bounty since 2014, paying up to $1,000,000 for access to Coinbase's wallets or keys
Publishes a yearly transparency report and, as a public company, reports serious incidents to the SEC

Coinbase holds the keys and can suspend or close your account at its sole discretion, with no obligation to disclose the details; after a closure you have 90 days to move your coins
A government ID and a selfie are required, and Coinbase sees every balance and transaction in the account
In a Coinbase bankruptcy, customers could be treated as general unsecured creditors
In 2025 bribed support staff stole customer names, addresses, ID images and transaction histories
Shares conversion data, including your IP address, with advertisers such as Meta and AppLovin
Closed source, with no published security audit of the consumer service

Our Rating

Coinbase suits people who want an account where a lost password can be recovered and who accept that the company holds their coins and knows who they are. It does not suit anyone who wants to control their own keys, keep their holdings separate from their identity, or keep access that no company can suspend.

Key Custody & Recovery2.5/10
Coinbase holds the private keys, often on addresses shared by many customers, and you can take your coins out only by asking Coinbase to send them. Its US agreement lets it suspend or close an account at its sole discretion, with no obligation to disclose the details of its decision; after a closure you have 90 days to move your coins out, unless the law, a subpoena or a court order blocks the transfer. Its annual report warns that in a bankruptcy customers could be treated as general unsecured creditors. In return, a lost password or 2-step verification device does not cost you the coins: an ID upload or trusted contacts restore access.
Network & Metadata Privacy1.0/10
An account requires a government ID and a selfie, and Coinbase may also ask for a taxpayer number, so every coin on it is tied to your name. Coinbase sees every balance and transaction, shares conversion data including your IP address with advertisers such as Meta, and may pass your details to the other side of a transfer under the Travel Rule. It received 12,716 government and law enforcement requests in its latest reporting year. Your own node, Tor and coin control do not apply to an account Coinbase runs.
Security & Transparency3.5/10
The apps and servers are closed source, and no security audit of the consumer service is published; the SOC reports Coinbase names cover its institutional products. A HackerOne bug bounty has run since 2014 and pays up to $1,000,000 for access to Coinbase's wallets or keys. In 2025 bribed support staff copied names, addresses, ID images and transaction histories of less than 1% of monthly transacting users; no keys or funds were taken, and Coinbase paid $311.2 million that year in reimbursements and legal costs. As a public company it reports serious incidents to the SEC and publishes a yearly transparency report, which is what lifts this score above the floor.
Usability & Chain Support8.0/10
The service runs in a browser and in apps for Android and iPhone, covers Bitcoin with Lightning, Ethereum and its main layer-2 networks, Solana and other large networks, and sends to other Coinbase users by email or phone number. Coinbase recommends a security key or passkey for 2-step verification. Some networks and Lightning are not available in every state or country, and restricted accounts can be blocked from sending crypto.
Price & Value7.0/10
Holding coins and sending them to other Coinbase users are free. A send to an outside address costs Coinbase's estimate of the network fee, which can exceed what Coinbase pays, and a Lightning send adds 0.2%. Buying, selling and converting include a Coinbase fee and a spread, both shown before you confirm.

Overall3.6/10

Key Custody & Recovery 30% · Network & Metadata Privacy 25% · Security & Transparency 20% · Usability & Chain Support 15% · Price & Value 10%

See our rating methodology →