Short answer: yes. Coinbase Wallet is a well-built self-custody wallet, and nobody has ever breached the way it stores your keys. Its real risks are the ones every self-custody wallet shares: losing your own access, and scammers who impersonate Coinbase. If you knew it as the "Base app," it's the same wallet; Coinbase changed the name back in September 2026.
We recover locked crypto wallets for a living, Coinbase Wallet included, so this review spends as much time on how people actually lose access as on the security features.
What is Coinbase Wallet (and what happened to the Base app)?
Coinbase Wallet is Coinbase's self-custody wallet: a mobile app for iPhone and Android, plus a browser extension for Chrome. Your keys live on your device, not with Coinbase.
The name has had a bumpy couple of years:
- July 16, 2025: Coinbase renamed the app the Base app and added social, chat, and payments features.
- September 10, 2026: after the social experiment fell short, Coinbase renamed it back to Coinbase Wallet and refocused it on trading.
Through both changes it stayed the same self-custody wallet. Your keys, addresses, and balances didn't move. Some Coinbase help pages still use the Base name, so here's the vocabulary:
- Base is Coinbase's Ethereum layer-2 network. It's a blockchain, not a wallet.
- Base account (formerly Smart Wallet) is a type of Coinbase Wallet account secured by a passkey instead of a recovery phrase.
One more 2026 change: Coinbase closed its "classic" wallet on August 15, 2026, and dropped several networks, including Litecoin, Bitcoin Cash, and XRP. Coinbase says assets on those networks are still at their addresses, and you can reach them by importing your recovery phrase into a wallet that supports those networks.
Coinbase Wallet vs your Coinbase account
This trips up a lot of people. Your Coinbase account is an exchange account: Coinbase holds the crypto for you, and Coinbase support can reset your password and verify your identity. Coinbase Wallet is self-custody: you hold the keys, so Coinbase can't reset anything, freeze anything, or recover anything. The two have separate balances, and you don't need an exchange account to use the wallet.
This review covers the wallet. For the exchange, see our Coinbase review, and for a side-by-side, read Coinbase vs Coinbase Wallet.
How Coinbase Wallet protects your crypto
Your keys stay on your device. Coinbase never holds your private keys, so it can't move your funds. The flip side: it can't recover your wallet either.
Three account types, three kinds of protection. Coinbase Wallet offers:
- A recovery-phrase wallet, backed by a standard 12-word phrase. Whoever has the phrase controls the wallet.
- A passkey wallet (the Base account, formerly Smart Wallet), secured by a passkey stored with Apple, Google, or a password manager. You can add a recovery key or an email sign-in as a backup.
- An email or social sign-in wallet, which you open with a one-time code.
Knowing which one you have matters most when something goes wrong. Coinbase warns that a passkey wallet or a recovery-phrase wallet with no backup method attached can't be recovered if you lose the passkey or phrase.
Device locks. The mobile app unlocks with a PIN, Face ID, or fingerprint. The browser extension uses a password you choose at setup, which encrypts the wallet in your browser.
Encrypted cloud backup (mobile only). You can back up your recovery phrase to iCloud or Google Drive. The backup is encrypted with a separate backup password you create, and Coinbase can't see or reset it. Some reviews say the backup unlocks with your PIN or biometrics. It doesn't: you need that backup password, so store it as carefully as the phrase.
Protection from risky dapps. Coinbase Wallet warns you before you open sites on its blocklist, shows a preview of what a transaction will do before you sign, alerts you to token approvals, lets you revoke old approvals, and hides known scam tokens. Previews are simulations, though, not guarantees, and Coinbase says so.
Hardware support. The extension works with Ledger hardware wallets, which keeps your keys off your computer entirely.
Code and bug bounties. Coinbase publishes the smart contracts behind passkey wallets as open source, and outside firms (Cantina, Certora, and Code4rena) have audited them. Coinbase runs a public bug bounty, expanded in 2025 with a $5 million program for its onchain products. We couldn't confirm whether the app itself is open source, so we won't claim it.
What it doesn't have: insurance. Self-custody crypto isn't insured. Coinbase Wallet isn't covered by FDIC insurance, whatever you may have read on Quora, and there are no chargebacks.
Has Coinbase Wallet ever been hacked?
It helps to separate three things people lump together.
1. The wallet itself: no breach of key storage. We found no documented case of anyone breaking how Coinbase Wallet stores keys. Researchers have found flaws, and each was disclosed and fixed:
- 2023, "Red Pill": the security firm ZenGo showed that malicious contracts could behave innocently during transaction previews in Coinbase Wallet and other wallets. Coinbase fixed it and paid a bug bounty.
- 2025, developer toolkit: a high-severity issue in Coinbase's Wallet SDK, the package other apps use to connect to the wallet. Coinbase fixed it and said it didn't directly affect users' keys or funds.
- 2026, a privacy leak: researchers at KU Leuven found that dozens of wallet extensions could let websites link your addresses together. Coinbase Wallet had fixed it by February 2026.
2. The Coinbase exchange: the May 2025 data breach. Criminals bribed overseas customer-support staff to pull Coinbase exchange customer data: names, addresses, phone numbers, emails, partial Social Security numbers, ID images, and account balances. About 69,000 people were affected, and Coinbase booked a $307 million charge. Coinbase's SEC filing says no passwords or private keys were compromised. Coinbase never holds Coinbase Wallet keys, so wallet keys weren't exposed.
It still matters to wallet users. Leaked personal details make impersonation scams far more convincing, and that's where the real losses have come from.
3. Scams. Most money lost "in Coinbase Wallet" goes to scams, not hacks. See the scams section below.
Your biggest risk is losing your own access
The most common way people lose crypto in Coinbase Wallet isn't a hack. It's getting locked out. Here's what Coinbase support can and can't do:
- It can't reset your extension password, your mobile PIN, or your cloud backup password.
- It can't recover or look up your recovery phrase, and it can't move your funds.
- It can reverse nothing, including a transfer to a scammer.
So your way back depends on what you still have:
- Forgot the extension password but have your 12-word phrase? Re-import the phrase and set a new password.
- Forgot the extension password and lost the phrase? Don't uninstall or reset the extension. The encrypted wallet is still in your browser, and that's what can be recovered. Read our Coinbase Wallet password recovery guide.
- Have some of your phrase, or it says invalid? A missing or mistyped word is often fixable. See our Coinbase Wallet recovery phrase guide.
- Lost the phone but have a cloud backup? Restore it with the same Apple or Google account and your backup password.
This is the work we do. If you've lost the password to the Coinbase Wallet browser extension, Crypto Asset Recovery may be able to recover it from the encrypted wallet in your browser, using your best password guesses. We run the cracking on offline, air-gapped machines, and you only pay if we succeed.
To be straight with you about the limits: we can't currently recover wallets that exist only on a phone, or crack a forgotten cloud backup password.
Coinbase Wallet scams to watch for
The "migrate to Coinbase Wallet" email. In 2025, a convincing mass email told Coinbase customers to move their funds into a self-custody wallet using a recovery phrase included in the email. The scammer had generated that phrase, so anything deposited went straight to them. Coinbase's response was simple: "We will never send you a recovery phrase."
Fake support calls. Scammers call from spoofed numbers, quote your real personal details (often from leaked data), and urge you to move funds "somewhere safe." The blockchain investigator ZachXBT tracked about $65 million stolen from Coinbase users this way in just two months around the end of 2024.
Fake support numbers in Google. As of this writing, a spam page listing a phone number ranks on the first page of Google for "is Coinbase Wallet safe." Don't call numbers from search results or ads. Find support by typing help.coinbase.com into your browser yourself.
Fake "mining pool" dapps. Scammers befriend victims online, then steer them to a fake liquidity-mining site inside the wallet's dapp browser, where one signature hands over control of their tokens.
Wallet drainers and token approvals. Malicious sites ask for unlimited token approvals. Read what you're signing, and revoke approvals you no longer need.
"Sign to prevent coin expiry." After the classic wallet closed in August 2026, messages appeared asking users to sign something to keep their coins. Coinbase says the closure needed no transfer or signature.
Address poisoning. Tiny transactions from lookalike addresses, hoping you'll copy the wrong address from your history. Check the whole address before sending.
If your crypto was stolen, Coinbase can't reverse it, and we don't recover stolen funds. We can refer you to a partner who investigates theft. Be wary of anyone who contacts you offering to get stolen crypto back for an upfront fee.
Best practices to stay safe on Coinbase Wallet
- Write your 12-word recovery phrase on paper or metal, store it offline, and never type it into a website.
- If you use a passkey wallet, set up a recovery key or email sign-in now, while you still have the passkey.
- If you use the cloud backup, protect the Apple or Google account behind it with a strong password and two-factor authentication, and store the backup password safely.
- Get support only through help.coinbase.com, typed in yourself. Coinbase will never send you a recovery phrase or ask for yours.
- Keep large balances on a Ledger connected to the extension.
- Revoke token approvals you no longer use, and keep a separate wallet for experimental dapps.
- If you held assets on a network Coinbase dropped, move them with a wallet that supports that network.
Verdict: Is Coinbase Wallet safe?
Coinbase Wallet is a solid, well-resourced self-custody wallet. Its key storage has never been breached, its disclosed flaws were fixed, and it adds useful guardrails such as dapp warnings, transaction previews, and approval controls. The 2025 breach hit Coinbase's exchange data, not wallet keys, but it fuels the impersonation scams that are now the biggest threat to wallet users.
Back up your recovery phrase or passkey properly, treat every unexpected "Coinbase" call or email as a scam, and Coinbase Wallet is a sound choice. For large holdings, add a hardware wallet.
Already lost access or been scammed?
- Forgot your extension password? Read how to recover a lost Coinbase Wallet password.
- Missing words, or does your phrase say invalid? See our Coinbase Wallet recovery phrase guide and our guide to recovering a phrase with a missing word.
- Can't remember which password you used? Try our tips on how to find old passwords.
- Funds stolen? We don't trace stolen crypto, but we can refer you to a partner who investigates theft.
Why Choose Crypto Asset Recovery to Recover Your Coinbase Wallet?
- Secure, offline recovery. The cracking runs on air-gapped, offline machines, so your keys are never exposed online.
- Thousands of wallets recovered across Coinbase Wallet, MetaMask, Trust Wallet, Blockchain.com, and more.
- Success-based pricing. You only pay if we get you back in.
- Talk to a real person. Reach out any time, and you can get on a Zoom with our founders, the father-and-son team Chris and Charles.
- Featured in BBC, Forbes, Vice, The Block, and Business Insider.
Frequently asked questions
Is Coinbase Wallet legit? Yes. Coinbase Wallet is made by Coinbase, a publicly traded US company, and it's one of the most widely used self-custody wallets. The fakes are the scam emails, support numbers, and lookalike sites that use its name.
Is the Base app the same as Coinbase Wallet? Is it safe? Yes, it's the same wallet. Coinbase called it the Base app from July 2025 until September 2026, then changed the name back. Your keys and balances were never affected by the rename, and the same safety advice applies.
Can Coinbase Wallet be hacked? No one has breached how Coinbase Wallet stores keys. Wallets get emptied when someone gives away their recovery phrase, signs a malicious transaction, or has malware on their device.
Is Coinbase Wallet insured or FDIC-protected? No. Self-custody crypto isn't insured, and FDIC coverage doesn't apply to crypto in Coinbase Wallet. If funds are stolen, there's no chargeback.
Can Coinbase recover my wallet or reset my password? No. Coinbase never has your keys, your extension password, or your backup password, so it can't reset or recover them. If you've lost the extension password and your phrase, the encrypted wallet in your browser may still be recoverable. Our password recovery guide explains how.
What is Coinbase Wallet's support phone number? Don't trust any phone number you find in search results or ads; fake Coinbase support numbers are a common scam. Go to help.coinbase.com by typing it into your browser, and use the contact options listed there.
Is Coinbase Wallet safe for storing a lot of crypto? For large balances, connect a Ledger hardware wallet to the extension so your keys never sit on an internet-connected device. Coinbase Wallet on its own is a hot wallet.
