Coinbase is a US public reporting company, which makes it one of the very few crypto platforms you can evaluate from primary documents rather than from marketing copy. Its Class A common stock trades on Nasdaq under COIN, and its annual report, quarterly reports and current reports sit in the SEC's EDGAR system under Commission File 001-40289. If you want to know what the company admits about itself, that is where you look.
Three events from 2025 belong in any serious evaluation, and most review pages carry none of them. The SEC moved to dismiss its civil enforcement action against Coinbase in February. Coinbase disclosed a material cybersecurity incident in a Form 8-K in May, involving insiders at overseas support contractors. And the company acquired Deribit, took on substantially more debt, and reincorporated from Delaware to Texas, all within the same year.
Disclosure: no affiliate links and no payment for signups on this page. Figures were read from SEC filings on EDGAR and from Coinbase's own help and legal pages on 15 September 2026. Where a number commonly repeated in reviews could not be traced to a primary source, it is not printed here and is listed as such below.
On 27 February 2025 the SEC announced in release 2025-47 that it had filed a joint stipulation with Coinbase Inc. and Coinbase Global Inc. to dismiss the ongoing civil enforcement action against the two entities. The stated context was the Crypto Task Force, announced on 21 January 2025 and dedicated to developing a comprehensive regulatory framework for crypto assets.
The sentence that matters is the one review sites leave out. The SEC wrote that its decision "rests on its judgment that the dismissal will facilitate the Commission's ongoing efforts to reform and renew its regulatory approach to the crypto industry, not on any assessment of the merits of the claims alleged in the action." The joint stipulation further states that the decision to seek dismissal "does not reflect the Commission's position on any other case."
Acting Chairman Mark T. Uyeda put it this way: "For the last several years, the Commission's views on crypto have been largely expressed through enforcement actions without engaging the general public."
Read that carefully. A dismissal on policy grounds is not a finding that the alleged conduct was lawful, and the SEC said so explicitly. Treat it as one fewer legal overhang, not as a certification.
On 15 May 2025, Coinbase Global filed a Form 8-K under Item 1.05 reporting a material cybersecurity incident with an event date of 14 May 2025. According to the filing, on 11 May 2025 Coinbase, Inc. received an email from an unknown threat actor claiming to have obtained customer account information and internal Coinbase documentation, demanding money in exchange for not publishing it.
The mechanism is the part that should change how you think about exchange risk. The threat actor appears to have obtained the information by paying multiple contractors or employees working in support roles outside the United States to collect data from internal systems they could already access to do their jobs. Coinbase says its own security monitoring detected the instances independently, and that it terminated the personnel involved.
Two limits are stated plainly. The incident did not involve the compromise of passwords or private keys, and at no time could the targeted personnel access customer funds. Those are genuine mitigations, and they are the reason this was not a loss of assets event.
But the exposure was downstream. Data of exactly this shape is what makes impersonation calls credible, and Coinbase said it was bolstering anti-fraud protections "to mitigate the risk that the compromised information could be used in social-engineering attempts." It said it did not pay the demand, is cooperating with law enforcement, and preliminarily estimated expenses "within the range of approximately $180 million to $400 million relating to remediation costs and voluntary customer reimbursements," cautioning that the figure could meaningfully move.
The operational lesson for a customer is narrow and specific. No amount of cold storage protects you from a convincing phone call made by someone holding your balance snapshot.
Assume that anyone who contacts you claiming to be Coinbase support is hostile until proven otherwise. Hang up and open the app yourself. Turn on a hardware security key rather than SMS codes, restrict withdrawals to allowlisted addresses, and treat an unsolicited request to move funds to a "safe" wallet as an attack, because in this incident that is precisely what it was.
Marketing numbers and filed numbers differ, and the filed ones are the ones you can check. Coinbase's 2025 annual report gives the following key performance and financial indicators.
| Metric | FY2025 | FY2024 | Change |
|---|---|---|---|
| Monthly transacting users (MTUs) | 9.2 million | 8.4 million | +10% |
| Assets on platform | $376 billion | $404 billion | -7% |
| Trading volume | $1,221 billion | $1,189 billion | +3% |
| Transaction revenue, net | $4,055.4 million | $3,986.1 million | +2% |
| Subscription and services revenue | $2,828.0 million | $2,307.1 million | +23% |
| of which stablecoin revenue | $1,348.8 million | $910.5 million | +48% |
| Net income | $1,260 million | $2,579 million | -51% |
| Adjusted EBITDA | $2,808 million | $3,348 million | -16% |
Two things stand out. User counts and volume rose while assets on platform fell, which is what a price-driven drawdown looks like when activity holds up. And the revenue mix is shifting away from trading fees: subscription and services, led by stablecoin revenue, is now a large and faster-growing second pillar.
The same filing records the acquisitions of Deribit in August 2025 and Gm Echo Ltd in October 2025, the reincorporation to Texas in December 2025, and long-term debt rising to $7.28 billion after $3.0 billion of convertible senior notes were issued in August 2025. A company with that balance sheet profile is not the same risk as a cash-rich custodian.
One caveat on the comparison. Deribit was acquired part way through the year, so 2025 figures include it for only part of the period while 2024 figures include none of it.
| Venue | Products | Assets |
|---|---|---|
| Coinbase Exchange | Spot trading | 360+ crypto assets |
| Coinbase International Exchange | Perpetual futures, spot | 200+ crypto assets |
| Coinbase Derivatives Exchange | Dated futures, perpetual-style futures | 35+ futures across crypto, commodities and equity indices |
| Deribit | Options, perpetual futures, dated futures, spot | 15+ crypto assets |
These are four separate venues with separate rulebooks and separate eligibility rules. Which one you can reach depends on where you live and how you are classified, and the count changes as assets are listed and delisted.
A long asset list tells you about selection, not about liquidity on any single pair. Depth is concentrated in a handful of assets, and the annual report's trading volume breakdown by crypto asset makes that plain.
Check the venue before you check the asset.
This is where generic reviews do the most damage, because they collapse three different protections into one sentence about insurance. Coinbase's own help page separates them, and so should you.
| What you hold | Protection | What it does not cover |
|---|---|---|
| Crypto assets | Crime insurance covering a portion of digital assets held across Coinbase's storage systems against theft, including cybersecurity breaches | Does not cover losses from unauthorised access to your own account caused by a breach or loss of your credentials. Crypto is not insured or guaranteed by the FDIC, NCUSIF or SIPC and may lose value |
| US dollar cash balance | Where held as cash, pooled custodial accounts at one or more FDIC-insured banks or NCUSIF-insured credit unions, arranged so Coinbase can claim pass-through insurance up to the per-depositor limit, currently $250,000 | Pass-through coverage is contingent on Coinbase maintaining accurate records and on the receiver's determination at the time of a bank failure. Funds may instead be held in US Treasuries or money market funds, which carry no FDIC coverage. Coverage applies to bank failure, not to a Coinbase failure |
| Securities held through Coinbase Capital Markets | SIPC membership, with clearing partner Apex Clearing, covering up to $500,000 per customer including $250,000 for cash; Apex also carries excess SIPC with a firmwide limit of $150 million | SIPC does not cover market losses. Once free credit balances move from Apex back to your Coinbase, Inc. USD balance, SIPC protection is lost |
The first row is the one most readers get wrong. Crime insurance is a corporate policy against theft from Coinbase's systems. It is not account insurance, and Coinbase states that it does not cover losses resulting from unauthorised access to your account through compromised or lost credentials.
The second row is more favourable than most reviews suggest, and more conditional. Pass-through FDIC coverage on USD balances is real but contingent, and it protects against a bank failing rather than against Coinbase failing.
Coinbase also publishes the list of insured depository institutions where US customer dollar funds may be held, naming JPMorgan Chase, Cross River Bank, Customers Bank, VyStar Credit Union and Pathward as of May 2025. If you hold deposits at one of those institutions directly, your coverage there and your Coinbase balance can interact with the same per-depositor limit.
The pattern across all three rows is the same and worth internalising: every one of these protections is triggered by a specific kind of failure at a specific institution, and none of them is triggered by a market move or by a decision you make yourself. Deposit insurance responds when a bank fails. SIPC responds when a brokerage fails. Crime insurance responds to theft from the company's systems. None of them responds to a bad trade, a falling price, a transfer you authorised, or a credential you handed over. Stablecoins add one more wrinkle, since a dollar balance held in USDC is a crypto asset rather than a cash deposit and is treated as such.
The following appear in widely circulated Coinbase reviews and could not be traced to an SEC filing or an official Coinbase page.
An evaluation that prints only what it can source is shorter. It is also the only kind worth acting on.
Everything above can be reproduced in under an hour.
That last step is the one people skip, and it is the one that decides everything else.
None of this says Coinbase is a poor choice. It says the reasons usually given for trusting it are the wrong reasons, and the real ones are documented, checkable, and more conditional than a review page suggests.
Crypto assets are volatile and can lose value in full. This article summarises SEC filings and Coinbase's own published policy documents as of 15 September 2026. It is not investment advice, not a recommendation to use any platform, and not a statement about the security of any account. Filings, fee schedules and insurance arrangements change. Confirm the current version before you rely on any of it.