Coinbase says it holds customer crypto for the customer, keeps US dollar balances in pooled custodial accounts with FDIC pass-through coverage of up to $250,000 per depositor (with conditions), and does not claim FDIC or SIPC protection for crypto itself. That last part is the one most people miss. As of November 2026, the pages I could load from Coinbase and from regulators draw a clear line between the protections that exist and the ones that do not.
I run Ecommerce Paradise, where most readers are building high-ticket stores, and crypto questions come up often once a store starts producing profit. This guide separates what Coinbase says about its own protections from what regulators say, and it only states things I could read on an official page.
Disclosure: some links below are affiliate links, which means I may earn a commission at no extra cost to you. This is general information, not financial advice, and I am not a licensed financial advisor. Terms change, so check the provider before you act. I will not tell you to buy, sell or hold anything.
Quick Answer: What Protects You and What Does Not
The table below summarizes the main protections, who states them, and the limit that matters. Every row comes from a Coinbase or regulator page I opened for this update.
| Topic | What the official source says | The catch |
|---|---|---|
| Crypto custody | Coinbase’s user agreement says supported digital assets are not Coinbase’s property and are not subject to claims of its creditors | You bear the risk of loss, and assets can sit in omnibus accounts |
| USD cash balance | Held in pooled custodial accounts; FDIC or NCUSIF pass-through up to $250,000 per depositor, per Coinbase | Depends on correct records and on a regulator’s determination if a holding bank fails |
| SIPC | SIPC says it does not protect any digital or crypto asset that does not qualify as a security | Coinbase’s own pages say crypto is not SIPC protected |
| Crime insurance | Covers a portion of digital currency against theft from Coinbase’s storage systems | Does not cover losses from your credentials being compromised; no dollar amount shown |
| 2-step verification | Security keys, authenticator apps and other methods, per Coinbase help pages | SMS-only is the weakest setup |
| Scams and phishing | Coinbase says it will never ask for your 2FA codes or for you to send crypto elsewhere | Crypto sends are usually irreversible, per the FTC |
How Coinbase Holds Customer Crypto
The clearest primary source is Coinbase’s own US user agreement. Section 2.7 says supported digital assets in your account are not property of Coinbase and are not subject to claims of Coinbase’s creditors. It also says Coinbase will not sell, transfer, loan or otherwise alienate them unless you instruct it to, with exceptions for legal requirements and the agreement’s own terms.
The same section says you bear all risk of loss for those assets. It also says Coinbase has no obligation to create a segregated blockchain address for your holdings, and that it keeps separate ledgers for each user’s account instead. In plain terms, your coins are tracked on Coinbase’s books, not necessarily sitting in a wallet with your name on it.
Coinbase’s annual report filed with the SEC describes the same custodial structure. It says financial assets held in the US for customers are not property of Coinbase and are not subject to claims of its general creditors. You can read that in the 2025 annual report on SEC.gov.
What I Could Not Verify About Bankruptcy
The agreement text I read does not spell out how US dollar balances would be treated if Coinbase itself became insolvent. I also could not load the risk-factor section of the annual report that would address custody in a bankruptcy, so I am not going to describe how a court would treat customer crypto. If that scenario matters to you, read the risk factors in Coinbase’s SEC filings directly, and consider talking to a lawyer.
FDIC Pass-Through Insurance on Your USD Balance
Coinbase is not an FDIC-insured bank, and its agreement says so. Section 2.8 says cash balances sit in pooled custodial accounts at financial institutions insured by the FDIC or the NCUSIF, and that pass-through insurance is available up to the per-depositor limit, which the agreement describes as currently $250,000 per individual. Coinbase’s cash help page adds that customer cash is held in accounts titled for the benefit of its customers.
The conditions are the important part. Coinbase says pass-through availability depends on factors including Coinbase having correct information about you, and on the determination of the relevant federal regulator acting as receiver. The agreement ties the insurance to a receivership of a holding bank or credit union, not to Coinbase failing.
Coinbase’s insurance page lists the institutions that hold cash and dates the $250,000 figure to May 2025. The list there names JPMorgan Chase, Cross River Bank, Customers Bank, VyStar Credit Union (for retail and business customer funds only) and Pathward. Partner lists change, so check the current page rather than trusting my copy.
Where the Money Can Also Go
Coinbase’s help page says amounts above its internal per-institution limits may go into short-duration investments such as US Treasuries or government money market funds, under state money transmission laws. It says customers should not assume cash is held one way or the other. Coinbase’s user agreement separately says it will not use customer funds for its operating expenses or other corporate purposes. The help page also says cash for Coinbase Capital Markets equities accounts is not subject to SIPC coverage.
What the FDIC Itself Says
The FDIC’s deposit insurance page says insurance applies to deposit accounts at FDIC-insured banks and lists crypto assets among the things not covered. It gives the standard limit as at least $250,000 per depositor, per insured bank, for each ownership category. So a Coinbase USD balance and a crypto balance are treated very differently.
What SIPC Does and Does Not Cover
SIPC protects customers of failed member brokerage firms. The SIPC page on what it protects says coverage is up to $500,000 per customer, including up to $250,000 for cash, and that it restores missing cash and securities when a member firm fails. It does not cover market losses or losses from bad advice.
On crypto, SIPC says digital assets that are unregistered investment contracts are not securities under the Securities Investor Protection Act, so they are not protected even if a SIPC member holds them. It also says it does not protect any digital or crypto asset that does not qualify as a security. Coinbase’s own legal pages say digital currency is not insured by the FDIC, the NCUSIF or SIPC. Both sources agree, so do not assume a SIPC sticker means your coins are covered.
Coinbase’s Crime Insurance, and Its Limits
Coinbase says it is covered by a crime insurance policy that protects a portion of the digital currency held across its storage systems against theft, including cybersecurity breaches. The same page says the policy does not cover losses from unauthorized access to your account that result from a breach or loss of your login credentials. It also does not cover NFTs.
The page shows no dollar amount for the policy. It also says that if a covered security event occurs, Coinbase will try to make affected users whole, but total losses may exceed insurance recoveries, so funds may still be at risk. Read that sentence twice. It is a good example of how an insurance headline and the actual terms can differ.
Security Features You Control
Most real-world losses come from account takeovers, not from exchange failures. Coinbase’s own security guidance, which I loaded from its help center, puts the control in your hands.
- Security key: Coinbase calls this the strongest 2-step option.
- Authenticator app: the next best option, per the same page.
- SMS-only codes: if this is your only option, Coinbase says to lock down your mobile account with a SIM lock or port freeze and a PIN.
- Address book allowlisting: limits withdrawals to addresses you saved, and after enabling it you have 8 hours to add addresses.
- Coinbase Vault: withdrawals need approval from multiple email addresses and carry a 48-hour delay during which you can cancel.
- Activity page: review it regularly and revoke sessions, devices or apps you do not recognize.
Coinbase’s account access page also lists passkeys and security keys among the 2-step options you can troubleshoot, so check which methods your account supports. Coinbase’s make your account more secure guide covers the steps in more detail. The security page on coinbase.com that I could load carries no date, so I am not repeating its cold storage percentage or other figures.
Proof of Reserves: What I Found
I could not find an exchange-wide proof-of-reserves statement on the Coinbase pages I loaded. The proof-of-reserves page I did find covers only cbXRP, Coinbase’s wrapped XRP token, and the figures there were refreshed on October 10, 2026. It does not name an independent attestor and says nothing about customer balances generally, so I am not treating it as evidence about your account. If you see a claim about Coinbase reserves elsewhere, ask for the primary source.
Past Incidents and Enforcement, From Primary Sources Only
I am keeping this section to what I could read in SEC documents. It is not a complete history, and I am not including anything I could not verify at the source.
The May 2025 Customer Data Incident
Coinbase disclosed a cybersecurity incident in a Form 8-K filed with the SEC, signed May 15, 2025. The filing says an unknown actor emailed Coinbase on May 11, 2025, claiming to have customer account information and demanding money. It says the actor appears to have paid overseas contractors or employees in support roles to pull data from internal systems.
The filing lists the data involved as names, addresses, phone numbers and emails, the last four digits of Social Security numbers, masked bank account numbers, images of government IDs, and account data such as balance snapshots and transaction history. It says the incident did not involve passwords or private keys, and that the targeted personnel never had access to customer funds. It also says Coinbase did not pay the demand and planned to voluntarily reimburse eligible retail customers who sent funds to the actor as a direct result of the incident.
The filing gave a preliminary cost estimate of about $180 million to $400 million for remediation and voluntary reimbursements, and said the figure could change. Coinbase’s later annual report repeats that no passwords or private keys were compromised and mentions ongoing litigation related to the incident, without giving details. The practical lesson is that stolen personal data fuels impersonation scams, which is why the scam section below matters.
The SEC Case Against Coinbase
The SEC’s press release dated February 27, 2025 says the Commission filed a joint stipulation to dismiss its civil enforcement action against Coinbase, Inc. and Coinbase Global, Inc. It says the decision was not based on the merits of the claims. It describes the move as part of the SEC’s effort to reform its crypto regulatory approach through the Crypto Task Force formed on January 21, 2025.
That is all I can say from the primary source. Other regulators and courts may have actions I did not review, so for a full picture search the SEC’s litigation releases and your state securities and banking regulators.
Account Recovery: What Coinbase Says Happens If You Lose Access
Coinbase’s account access page lists separate paths for a compromised account, a forgotten password, a lost email and a lost 2-step method. For a lost 2-step device, its troubleshooting page says to sign out, go to the account recovery page, enter your email and password, choose another way, and use an available option such as uploading ID, answering security questions or using a security key.
If you upload ID, the page says review can take up to 24 hours. It also says that even after you are verified, fund transfers may be unavailable for 24 hours. That delay is annoying, but it is also a speed bump for someone who has your password and a stolen phone. Once you are back in, update your 2-step method immediately.
Scams: The Biggest Practical Risk
Coinbase’s page on technical support and impersonation scams says it will never ask for your 2FA codes or passwords, never ask for remote access to your computer, and never ask you to send crypto to an external address. It warns that caller ID can be spoofed and that scammers post fake support numbers online. Use only the contact details on Coinbase’s own Contact Us page.
The FTC’s guidance on cryptocurrency scams adds the pattern to watch for: anyone demanding payment in crypto, promises of guaranteed returns, and pressure from someone you met online. The FTC also says crypto transactions are usually irreversible and lack the consumer protections that credit cards offer. If you are targeted, the FTC points to ReportFraud.ftc.gov, and it also lists the SEC, the CFTC, the Internet Crime Complaint Center (IC3) and the exchange you used.
Using Coinbase Alongside a Store, Without Mixing the Money
If you run a store, the safest habit has nothing to do with Coinbase’s security settings. Keep business money and personal money in separate places. Ad platforms, suppliers and payment processors run on bank accounts and cards, so a crypto account is usually a personal side decision, not a business tool.
Before any business funds go near an exchange account, set up the company correctly using my business formation checklist. Then open a dedicated business bank account. My walkthrough for opening a Mercury account shows one option.
An accountant can tell you how any crypto activity should be recorded. My guide to crypto tax software covers the record-keeping side.
A store only throws off profit if it sells things people actually want at real margins. If you have not picked a niche yet, start with what high-ticket dropshipping is. After that, my high-ticket niches list is the next stop.
Reliable sourcing matters just as much, and my guide on how to find suppliers for high-ticket dropshipping shows how I approach it.
A Balanced Look: Reasons for Comfort and Reasons for Caution
Here is how I would frame it without telling anyone what to do. On the comfort side, Coinbase’s agreement says customer crypto is not its property and not subject to its creditors’ claims, it lists named banks for USD cash, it offers security keys, a vault with a withdrawal delay and address allowlisting, and the SEC dismissed its civil enforcement action in 2025 (not on the merits, per the SEC).
On the caution side, crypto has no FDIC or SIPC protection, the crime insurance has limits and no stated amount, a 2025 incident in which paid insiders pulled customer data raised the risk of impersonation scams, and I could not verify how custody assets are treated in a Coinbase bankruptcy. The pass-through coverage on dollars has conditions. Your own account hygiene decides a large share of your risk.
If you want to compare costs and platforms, my Coinbase pricing and fees guide goes deeper. My Robinhood vs Coinbase comparison covers the other side.
If you decide to open an account, you can create a Coinbase account here, and I would start with the security settings before adding money. I am not recommending that anyone open an account, buy crypto or hold any amount of it.
A Short Safety Checklist
- Use a unique password from a password manager, and turn on 2-step verification for your email too.
- Prefer a security key or authenticator app over SMS-only codes.
- Turn on address allowlisting before you send crypto out.
- Remember that Coinbase staff will never ask for your codes or tell you to move crypto to fix a problem.
- Bookmark the Coinbase website and contact it only through the Contact Us page.
- Do not put in money you need for ad spend, supplier invoices or taxes.
- Read the current terms and insurance pages yourself, because they change.
Frequently Asked Questions
Is Coinbase FDIC insured?
Coinbase is not an FDIC-insured bank. Its agreement says US dollar cash sits in pooled custodial accounts at FDIC or NCUSIF insured institutions, with pass-through coverage up to $250,000 per depositor, subject to conditions. The FDIC says crypto assets are not covered by deposit insurance.
Is crypto on Coinbase covered by SIPC?
No, according to both sources. Coinbase’s insurance page says digital currency is not insured by the FDIC, the NCUSIF or SIPC, and SIPC says it does not protect any digital or crypto asset that does not qualify as a security.
Has Coinbase been hacked?
Coinbase disclosed a May 2025 incident in an SEC filing where insiders at support operations were paid to take customer data. The filing says it did not involve passwords or private keys and that the personnel never had access to customer funds. I did not review any other incidents, so check the SEC filings for the latest.
What should I do if I get a call claiming to be from Coinbase?
Hang up. Coinbase says it will never ask for your 2FA codes, passwords or remote access, and it says caller ID can be spoofed. Contact Coinbase only through the details on its own Contact Us page, and report scams to the FTC at ReportFraud.ftc.gov.
Can I get my account back if I lose my phone?
Coinbase’s help page describes a recovery flow with ID upload, security questions or a security key. Review can take up to 24 hours, and fund transfers may be unavailable for 24 hours afterward. Set up a second 2-step method now so you do not depend on one device.
Related Articles
If you found this useful, these guides go deeper on related topics:
- How to Use Coinbase in 2026: Sign Up, Verify, Buy, Send and Stay Safe
- Coinbase Pricing and Fees 2026: What You Really Pay on Every Trade
- Coinbase vs Kraken 2026: Fees, Coins, Safety and Who Each Fits Best
- Best Crypto Wallets 2026: Exchange, Hardware and App Picks Compared
- Coinbase Alternatives 2026: 7 Exchanges Compared and When to Stay
Not financial advice. Terms, insurance coverage, banks and fees change, so check Coinbase and the regulators directly before you act.
Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.
He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.
