Is Coinbase a Scam?

Our verdict

In 2021, attackers exploited a flaw in Coinbase's SMS-based two-factor authentication and drained roughly 6,000 accounts — $21.5 million gone before the company patched the hole. Coinbase reimbursed every victim. The incident reveals two truths at once: Coinbase is a legitimate, accountable company, and crypto security failures can be catastrophic.

Coinbase (NASDAQ: COIN) went public in April 2021 and is registered as a Money Services Business with FinCEN, holds licenses in most U.S. states, and registered as a Restricted Dealer in Canada in 2024 — meaning Canadian users can trade through Coinbase under provincial securities oversight. The SEC filed charges in 2023 alleging Coinbase operated as an unregistered exchange and broker in the U.S., a case that reshaped crypto regulation. It holds over $130 billion in customer assets as of late 2025. This is a real, audited financial institution — with real regulatory heat.

The biggest risk to Coinbase users is not Coinbase itself — it is scammers impersonating Coinbase. Blockchain investigator ZachXBT documented over $65 million in social engineering losses from Coinbase users in just December 2024 through January 2025. The FBI's IC3 reported over $5.6 billion in crypto fraud losses in 2023, and impersonation of exchanges is one of the top vectors. The script is predictable: a call or text warns of unauthorized account activity, directs you to a fake website, and captures your credentials or convinces you to install remote access software.

Customer support has been Coinbase's Achilles' heel. During market volatility, users report locked accounts, multi-week response times, and difficulty reaching a human. The BBB gives Coinbase a middling rating driven largely by support complaints. Coinbase has added phone support for account takeovers, but the experience still lags behind traditional banks.

Crypto transactions are irreversible by design. If you send Bitcoin or Ethereum to a scammer's wallet, no one — not Coinbase, not the police, not the blockchain — can reverse it. This is fundamentally different from disputing a credit card charge. The CAFC warns Canadians specifically that cryptocurrency sent to a fraudulent wallet is almost always unrecoverable.

Use Coinbase with hardware security keys or an authenticator app — never SMS codes. Never share credentials with anyone claiming to be support. Verify all communications by logging into coinbase.com directly. And understand the core reality of crypto: once it leaves your wallet, it is gone.

Editorial note: This article reflects the state of publicly available information at the time of writing. Business practices, ownership, and safety records change over time. TrustChekr is not affiliated with any company reviewed here and does not receive payment for editorial coverage. Verdicts are based on documented evidence and are subject to revision.