Is Coinbase safe? For buying crypto and keeping a trading balance, it's one of the more transparent options in the US: a public company that publishes audited financial statements, with a user agreement that says the coins in your account stay legally yours. The risks that remain sit mostly around your account rather than inside Coinbase's vaults, because its crime insurance doesn't cover losses from stolen logins, crypto balances aren't FDIC insured, and the 2025 leak of customer data made impersonation scams more convincing. That makes Coinbase a reasonable place to buy and trade, while savings you don't plan to touch for months belong in a wallet you control.
We make a hardware wallet, so we have a view on where long-term coins belong. Everything below links to Coinbase's own pages, so you can weigh the evidence yourself.
What Coinbase does to protect the crypto it holds
Coinbase's security page points out that it became a public company in April 2021, which means it publishes financial statements every quarter and is audited each year by an independent firm, as the law requires. That doesn't make it immune to problems, although it does mean its finances and major incidents are disclosed to regulators and investors in a way that private offshore exchanges aren't.
The more important promise sits in the Coinbase user agreement. Section 2.7.1 says title to your supported digital assets stays with you, that the assets Coinbase holds for customers aren't Coinbase's property, and that they aren't subject to claims from Coinbase's creditors. The next clause adds a detail worth knowing: Coinbase may keep customer coins in shared blockchain addresses that it controls, tracked on its ledger, with no obligation to give you a separate address. Your balance is a record in Coinbase's books, and moving it anywhere still depends on Coinbase processing your withdrawal.
On top of that, Coinbase carries crime insurance that protects a portion of the digital assets held across its storage systems against theft, including cybersecurity breaches. The word "portion" matters, and so does the exclusion that follows it.
Is Coinbase FDIC insured?
Your crypto isn't. Coinbase's help article on how Coinbase is insured states that it isn't an FDIC-insured bank and that crypto isn't insured or guaranteed by the FDIC, the credit union fund (NCUSIF) or SIPC.
US dollar cash is treated differently. To the extent your dollars are held as cash, Coinbase keeps them in pooled custodial accounts at insured banks and credit unions, including JPMorgan Chase, Cross River Bank, Customers Bank, VyStar Credit Union and Pathward, set up so that each customer can claim pass-through FDIC or NCUSIF insurance up to 250,000 USD if one of those banks fails. That coverage depends on Coinbase keeping accurate records, and Coinbase's page on how it stores customer cash notes that any money you hold at the same bank in your own name counts toward the same 250,000 USD limit. Stocks bought through Coinbase fall under a third regime, SIPC protection through its brokerage arm, which covers the failure of the broker and never covers market losses.
The FDIC itself lists crypto assets among the financial products it doesn't insure, so if anyone tells you your Bitcoin on an exchange is FDIC insured, that claim is wrong. Our article on what crypto insurance covers goes through the other kinds of policies you'll see advertised.
Where the risk sits: your account
Coinbase's crime insurance comes with a clear exclusion: it doesn't cover losses from unauthorized access to your personal account caused by a breach or loss of your credentials. If someone gets into your account with your password and codes, or talks you into sending coins yourself, that loss falls outside the policy.
That's why the incident Coinbase disclosed on 15 May 2025 matters to anyone keeping a balance there. Criminals paid a small group of overseas support agents to copy data from Coinbase's support tools for less than 1% of its monthly transacting users, including names, home addresses, phone numbers, the last four digits of Social Security numbers, images of government IDs, balance snapshots and transaction history. Coinbase said no passwords, two-factor codes, private keys or funds were exposed, refused a 20 million USD extortion demand, and said it would reimburse customers who were tricked into sending funds to the attackers.
What that leak hands a scammer is credibility. A caller who knows your name, your address and roughly what you hold can sound a lot like Coinbase support, and Coinbase says plainly that it will never ask for your password or two-factor codes, or ask you to move funds to a new wallet or address. Our breakdown of the Coinbase withdrawal code scam shows how that pattern usually starts. If you keep a balance on Coinbase, Coinbase's advice is to use a hardware security key for two-factor login and to turn on withdrawal allow-listing, so coins can only go to addresses you've approved in advance.
Can Coinbase freeze your account?
Coinbase's help page on account restrictions says it freezes funds only in what it calls extremely rare circumstances: when a court or other authority orders it to, or when sanctions law requires it. It can also switch off buying and selling for accounts that break its user agreement, and close accounts for prohibited activity; in both cases the page says you can still send your crypto to an external wallet and cash out to your verified bank account.
The more common experience is a hold on newly deposited cash, which lets you trade straight away but stops you sending crypto off Coinbase until your bank payment clears. It isn't a sign that anything is wrong with your account, although it does show that the timing of a withdrawal is Coinbase's call.
Is Coinbase safe for money you leave there?
It depends on what the money is for. A balance you trade with, or cash you expect to spend in the next few weeks, sits reasonably well on Coinbase, as long as your login is locked down with a hardware security key and allow-listing is switched on. Savings you plan to hold for months or years are a different case, because every protection described above runs through Coinbase: its records, its insurance terms, its support team and its decision to process your withdrawal.
Moving those savings to self-custody takes Coinbase out of that chain, so no support agent, insurance exclusion or account restriction sits between you and your coins. The trade-off is that you take on the backup, and losing it with no recovery plan means losing the coins. Most people end up with a split along those lines, which we cover in how many crypto wallets to keep, and our guide on how to move crypto from Coinbase to a cold wallet walks through the transfer screen by screen.
Where Ryder One fits
The Ryder One is built for the savings half of that split. Keys are generated inside an EAL6+ certified secure element and never leave it, and you can show your receive address on the device's own screen before you paste it into Coinbase, so malware on your phone can't swap it. Recovery runs through TapSafe, which splits your backup between a Recovery Tag and an encrypted copy in your phone's iCloud or Google Drive, with the seed phrase still available on the device as a last resort. The Starter Combo was 149 USD on ryder.id when we checked on 22 October 2026.
Share: