Don't click anything in an email that claims to be from Coinbase and asks you to act fast. Open the Coinbase app, or type coinbase.com into your browser, and check your account there. If something really needs your attention, you'll see it in your account. If the email asks for your recovery phrase, your password, a verification code, or for you to move your crypto, it's a scam, whatever address it came from.
Coinbase email scam or the real thing? How to check
Coinbase says its real emails come from these domains (source):
- coinbase.com
- mail.coinbase.com
- updates.coinbase.com
- info.coinbase.com
- cb.mail.coinbase.com
To see the real sender, look past the display name, which anyone can set to "Coinbase." In Gmail, click the sender's name or the small arrow under it. In Apple Mail, hover over the name. In Outlook, open the full From field. The address you need is the one in angle brackets, like <[email protected]>.
That rules out obvious fakes, such as "[email protected]" or a lookalike domain. It doesn't prove an email is real: Coinbase warns that sender addresses can be spoofed, and the 2025 phishing email described below passed the standard email-authentication checks. So use the address as a first filter, then look at what the email asks for:
- Does it match something in your account? Open the app yourself. A real security alert, account review or product notice will show up there too.
- Does it ask for something Coinbase never asks for? Coinbase never asks for your password, a two-step verification code or a recovery phrase, and never tells you to move funds to a "safe" wallet or an address it supplies.
- Does it rush you? Deadlines and threats to close your account are pressure tactics.
The fake Coinbase emails going around
"Migrate your funds to a self-custody wallet"
In March 2025, a large phishing campaign told Coinbase customers that a court ruling required them to move their funds to Coinbase Wallet. As BleepingComputer reported, it was sent through a legitimate email service and passed the usual sender checks. It linked to the real Coinbase Wallet app, which made it look legitimate, but it also supplied a recovery phrase for the "new" wallet. The scammers already had that phrase, so anything sent to the wallet was theirs.
No legitimate company will ever give you a recovery phrase. If an email hands you one, the wallet belongs to whoever wrote the email.
"Unusual sign-in" or "your account is locked"
These emails warn of a sign-in from an unknown device, or say your account is restricted, and link to a page that looks like the Coinbase login. Anything you type there goes to the scammers, including the verification code they need to get into your real account. Many add a fake case number or a link to a "secure portal" to look official.
"Cancel this withdrawal" with a phone number
Like the Coinbase scam texts, some emails claim a withdrawal is pending and give a number to call if it wasn't you. The person who answers poses as Coinbase support and talks you into moving your crypto.
Breach compensation and "settlement" emails
Coinbase's May 2025 data breach exposed names, emails, phone numbers and other details of tens of thousands of customers, so expect fake "compensation" and "refund" emails. Lawsuits over the breach have been consolidated for pretrial proceedings in federal court in New York, and we found no court-approved settlement or claim deadline as of October 2026. Treat any email asking you to "claim your Coinbase compensation" through a link as phishing. A real class settlement would come with a court-approved notice website and wide news coverage.
Real Coinbase emails that can look suspicious
Some unexpected Coinbase emails are genuine. These two kinds catch people out:
- Account reviews. Coinbase sometimes asks for identity or compliance documents. Upload them only through the app or coinbase.com, never by replying to an email.
- Product changes. Coinbase gives advance notice when products close. Its Web3 wallet shut down on December 10, 2025, and the classic Coinbase Wallet app closed on August 15, 2026. A real notice never supplies a recovery phrase, links you to a page that asks for yours, or tells you to send funds to an address in the email.
What to do with a suspicious Coinbase email
If you haven't clicked anything
- Don't click links, open attachments or call any number in it.
- Report it to [email protected]. Coinbase asks you to include the full email headers, which you can copy in Gmail with "Show original" or in Outlook with "View message details" (in classic Outlook, File > Properties).
- Mark it as phishing in your email app. Keep a copy if you entered any details or sent funds, since you'll need it as evidence.
If you clicked a link or entered your details
If you typed your email, password or a verification code into a page from the email, assume the scammers have them.
- Lock your Coinbase account straight away from the Security section of your account settings, or at accounts.coinbase.com/security. Coinbase explains the steps here; locking signs out every device and pauses transactions.
- Change your Coinbase password and your email password, then check your email account for forwarding rules or signed-in sessions you don't recognize.
- Switch two-step verification to a passkey or security key.
- If you downloaded anything from the email, scan your device or reset it before signing in again.
If you can't sign in, find the support contact on Coinbase's compromised-account help page. Never use a number or link from the email.
If you already sent crypto or used a recovery phrase they gave you
Move anything left in that wallet to a new wallet with a new recovery phrase, on a clean device. Report the theft to Coinbase support, the FBI at ic3.gov and the FTC at reportfraud.ftc.gov, and keep the email, the transaction IDs and the addresses you sent to. Our guide on how to recover stolen crypto covers what to save and what happens next. If you sent funds to an Ethereum address, our free scam checker shows whether it has been reported. Expect follow-up emails from fake "recovery experts" or government agents offering to get the money back for a fee; the FBI warns these are scams too.
Will Coinbase refund you?
Rarely, if you approved the transfer yourself. Coinbase said it would reimburse retail customers who were tricked into sending funds to scammers as a direct result of its May 2025 breach, for losses before its May 15, 2025 announcement. Coinbase One's account protection covers some unauthorized account takeovers, but it excludes transfers you authorize by mistake. Our Coinbase scam text guide explains the conditions in more detail.
Locked out of a wallet you own?
Our work is different from scam recovery: we help people who forgot the password to a wallet they own, such as a Coinbase Wallet browser extension, or lost part of its recovery phrase. We run the cracking offline and charge only when we succeed.
Frequently asked questions
What email address does Coinbase use?
Coinbase says its emails come from coinbase.com, mail.coinbase.com, updates.coinbase.com, info.coinbase.com and cb.mail.coinbase.com. Sender addresses can be faked, though, so check any request by opening the Coinbase app yourself.
How do I report a Coinbase phishing email?
Send it to [email protected] with the full email headers, which you can copy from "Show original" in Gmail or "View message details" in Outlook. Then mark it as phishing.
Is the Coinbase "migrate your funds" email real?
No. Coinbase doesn't email you a recovery phrase or tell you to move funds to a wallet it sets up for you. A 2025 phishing campaign used exactly that story, and anything sent to the wallet it provided went to the scammers.
Is the Coinbase data breach settlement email real?
Treat it as phishing. As of October 2026, we found no court-approved settlement or claim deadline for the May 2025 breach. Don't click "claim your compensation" links; a real settlement would have a court-approved notice website and wide news coverage.
What happens if I clicked a link in a Coinbase scam email?
If you didn't enter anything, close the page and scan your device. If you entered your password or a code, lock your Coinbase account, change your Coinbase and email passwords, and switch to a passkey or security key.
Does Coinbase ask you to verify your identity by email?
Coinbase can ask for identity documents during an account review, but you should only upload them through the Coinbase app or website. Never send documents by replying to an email or through a link in one.
