
Centralised exchange
Coinbase
2012 · United Statescoinbase.com ↗
Also known as Coinbase Global, Coinbase Advanced, Coinbase One, COIN, Coinbase Pro, GDAX
coinbase withdrawal code text
A text that says "Your Coinbase withdrawal code is…" and tells you to call a number if you did not request it is a phishing scam, not a Coinbase alert. Coinbase does not ask you to phone a number in response to a code; the number reaches a fake support agent who will try to get you to move funds, install remote-access software or read out codes. Don't call it. Open the Coinbase app yourself and check your account from there.
Our read
Coinbase has the fullest public record of any crypto exchange: quarterly SEC filings, audited annual accounts and a board that answers to shareholders. It suits people who want a US-regulated counterparty and will use Coinbase Advanced rather than the one-tap buy screen, where the spread is not shown as a fee. The thing to watch is the people around the product rather than the ledger: the 2025 insider data leak fed phone scams that still target its customers.
Key facts
- Q2 2026 results
- Net loss $359.5m; adjusted EBITDA $207.8m; record 10.3% crypto trading volume share
- Jun 2026 · Coinbase Investor Relations ↗
- Average USDC held on platform
- $20bn in Q2 2026, over 30% of USDC in circulation
- Jun 2026 · Coinbase Investor Relations ↗
- Coinbase Advanced, US entry tier
- 0.50% maker / 0.90% taker; qualifying threshold cut to $10,000
- Sep 2026 · Investing.com ↗
- Staking commission
- 35% of rewards standard; 25.25–31.75% for Coinbase One tiers
- Sep 2026 · Datawallet ↗
The "Coinbase withdrawal code" text is a scam
More people search for this text message than for Coinbase's fees. The wording varies but the pattern doesn't: "Your C0INBASE withdrawal code is: 1243218. If this was NOT requested by you, call us at +1…". Often the O is a zero so the message gets past carrier spam filters. It arrives whether or not you have a Coinbase account, because the senders work from bulk phone lists and leaked customer data.
The code does nothing. The phone number is the whole trick. It goes to someone playing a Coinbase support agent, who "confirms" that a hacker is draining your account and then walks you through "protecting" it. Malwaretips documented the script in August 2025, and it matches what US county sheriffs and prosecutors have put out in their own alerts.
- Move your crypto to a "safe" or "vault" wallet. The wallet belongs to the caller.
- Install AnyDesk, TeamViewer or a similar tool so the "agent" can "secure" your device.
- Read out a 2FA code, recovery phrase or password. Real Coinbase staff never ask for these.
- Buy gift cards to "verify" your identity.
It works better against Coinbase customers than most phishing because some of the callers really do know your name, address and balance. In May 2025 Coinbase told the SEC that criminals had bribed overseas support contractors to pull customer records, including names, addresses, phone numbers, partial Social Security numbers, ID images and balances. A caller who reads your own details back to you is using that kind of data. It is not proof they work at Coinbase.
- 01Don't call the number or reply to the text.
- 02Open the Coinbase app or type coinbase.com yourself, and check Activity for any withdrawal you didn't make.
- 03If a sign-in or withdrawal attempt shows up that wasn't you, change your password and move 2-step verification from SMS to a passkey or security key.
- 04Forward the text to 7726 (SPAM) so your carrier can block the sender, then report it to Coinbase through the in-app help centre.
A real withdrawal code only appears while you are making a withdrawal yourself. If you weren't sending anything, the text is fake.
Is Coinbase safe and legit?
It is a real, regulated business. Its balance sheet is more visible than any other exchange's: Coinbase Global files 10-Qs and an audited 10-K with the SEC, and it has been in the S&P 500 since 19 May 2025. Its 2025 10-K reports $7.18 billion in revenue and $1.26 billion in net income. No offshore venue gives an outsider that kind of view of its liabilities.
Coinbase has never lost customer funds through a breach of its own wallets. Its record on account security and compliance is weaker, and you should know it before deciding how much to leave there:
| When | What happened | Outcome |
|---|---|---|
| Mar–May 2021 | Phishing plus a flaw in SMS account recovery let attackers empty about 6,000 customer accounts | Coinbase patched the flow and says it reimbursed affected users |
| Jan 2023 | NYDFS found a backlog of more than 100,000 unreviewed AML alerts | $50m fine plus $50m compliance spend |
| May 2025 | Bribed overseas support staff leaked data on fewer than 1% of monthly transacting users | Coinbase refused a $20m ransom and put costs at $180m–$400m, including reimbursing customers who were tricked |
| Nov 2025 | Central Bank of Ireland: 30m+ transactions went unmonitored over 12 months | €21.46m fine on Coinbase Europe |
Keep in mind what a Coinbase balance is in law. In a May 2022 10-Q the company warned that customers' custodial crypto could be treated as part of a bankruptcy estate, which would make them unsecured creditors. No US exchange insolvency has yet tested how a court would treat Coinbase customers. Crypto on Coinbase has no FDIC cover. Only USD cash held at partner banks can qualify.
Is it legit? Yes, it is the exchange US regulators know best. Is it safe? The practical risks are phishing and SIM-swap attacks on your own login, not the company going under. A passkey or hardware security key closes most of that gap.
Coinbase fees: the simple app vs Coinbase Advanced
How much Coinbase charges depends on which screen you trade from. The one-tap Buy/Sell screen in the main app adds a transaction fee plus a spread built into the quoted price. The spread is not listed as a fee, so the receipt understates the cost. Coinbase Advanced (the old Coinbase Pro / GDAX order book) uses a published maker/taker schedule with no spread on top.
On 16 September 2026 Coinbase rewrote the Advanced schedule. Volume tiers now combine spot and derivatives, the first discount starts at $10,000 of 30-day volume instead of $25,000, and holding USDC can qualify an account for a VIP tier on its own. Entry pricing now depends on region:
| Region (Advanced, entry tier) | Maker | Taker |
|---|---|---|
| United States | 0.50% | 0.90% |
| EU and UK | 0.25% | 0.50% |
| Brazil, India, other international | 0.09% | 0.10% |
| Top tier (VIP8) | 0.00% | 0.02% |
Under the new schedule, VIP status by USDC balance starts at $500,000 for Advanced 1 and rises to $15 million for VIP 2. Few retail users will get there, but it shows what Coinbase wants most from customers: USDC balances.
- Coinbase One ($4.99–$299.99 a month) waives trading fees up to a monthly cap. The spread still applies.
- Staking keeps 35% of the rewards on most assets (25.25–31.75% for Coinbase One members). This is the fee people check least. See the Coinbase staking card.
- US bank transfers: ACH is free; a wire costs $10 to deposit and $25 to withdraw.
- Crypto withdrawals pay the network fee. Coinbase quotes it on the confirmation screen.
Does Coinbase charge fees? On every trade, yes. The only question is whether you can see them. A US buyer who moves from the simple screen to Advanced and places limit orders pays a published percentage instead of a hidden spread. For regular purchases, that one change makes the biggest difference to what you pay.
What is Coinbase, and who runs it?
Coinbase Global, Inc. runs a US crypto exchange and custodian. Brian Armstrong, a former Airbnb engineer, founded it in June 2012 after Y Combinator; Fred Ehrsam, a former Goldman Sachs trader, joined as co-founder. Armstrong is still chair and CEO. The company went remote-first in 2020 and has had no formal headquarters since. It listed on Nasdaq by direct listing on 14 April 2021, with a $250 reference price.
The retail app is now a small part of what Coinbase sells. In Q2 2026, subscription and services revenue ($555 million) was almost as large as transaction revenue ($599 million). It comes from interest on USDC reserves, custody for spot bitcoin and ether ETFs, and staking. Coinbase co-founded USDC with Circle and held an average of $20 billion of it on platform that quarter. It also runs Base, an Ethereum layer-2 network.
| Product | What it is |
|---|---|
| Coinbase app | Retail buy/sell, staking, USDC rewards, US stocks and ETFs |
| Coinbase Advanced | Order-book trading with maker/taker fees; spot, futures and perpetuals |
| Coinbase One | Monthly subscription: fee waivers, higher USDC yield |
| Coinbase Prime / Custody | Institutional trading and qualified custody, used by many US spot ETFs |
| Deribit | Crypto options exchange, bought for $2.9bn (closed Aug 2025) |
| Coinbase Wallet / Base | Self-custody wallet app and the Base layer-2 network |
2026 has been a year of cuts and new bets. On 5 May Coinbase said it would lay off about 700 people (14% of staff) and cut management layers, giving AI tooling as the reason. It reported a $359.5 million net loss for Q2 as crypto prices fell, while prediction-market revenue passed a $100 million annualised run rate. In September it agreed to buy The Clearing Company, a prediction-markets firm, and opened stock and ETF trading to all US customers.
On regulation, the SEC's June 2023 lawsuit over unregistered trading and staking was dismissed by joint stipulation on 27 February 2025, with no penalty. Coinbase gave $49 million to the Fairshake super PAC in 2024 and lobbies openly on US market-structure law.
Incident log
8 entries · repaid, confirmed: 0 of 2 where user funds were at stake
Regulatory
Central Bank of Ireland AML fine on Coinbase Europe
A misconfigured monitoring system left more than 30 million transactions (over €176bn) unmonitored for 12 months. The Central Bank of Ireland fined Coinbase Europe €21.46m after a 30% settlement discount — its first enforcement action against a crypto firm.
No funds at stakeRegulatory penalty; no customer funds at stake.Data breach
Insider data leak and extortion attempt
Criminals bribed overseas support contractors to copy customer records (names, addresses, phone numbers, partial SSNs, ID images, balances) for fewer than 1% of monthly transacting users, then demanded $20m. Coinbase refused, fired the staff involved and estimated $180m–$400m in remediation and voluntary reimbursement of customers who were socially engineered into sending funds.
Repaid — company's word onlyCoinbase's 8-K says it intends to reimburse eligible retail customers who sent funds to the scammers; no independent confirmation of payouts found.Regulatory
FCA fine on CB Payments for onboarding high-risk customers
The UK Financial Conduct Authority fined Coinbase's UK unit £3.5m for breaching a 2020 voluntary agreement not to onboard high-risk customers.
No funds at stakeRegulatory penalty; no customer funds at stake.Regulatory
SEC lawsuit over unregistered exchange and staking (dismissed 2025)
The SEC sued Coinbase for operating an unregistered exchange, broker and clearing agency and for its staking programme. On 27 February 2025 the SEC and Coinbase filed a joint stipulation to dismiss; no fine or admission.
No funds at stakeCase dismissed without penalty; no customer funds at stake.Regulatory
Dutch central bank fine for operating without registration
De Nederlandsche Bank fined Coinbase €3.3m for serving Dutch customers before it was registered.
No funds at stakeRegulatory penalty; no customer funds at stake.Regulatory
NYDFS $100m AML settlement
New York's Department of Financial Services found significant failings in Coinbase's KYC and transaction monitoring, including a backlog of over 100,000 alerts. Coinbase paid a $50m fine, committed $50m to compliance improvements and accepted an independent monitor.
No funds at stakeRegulatory penalty; no customer funds at stake.Hack
Account takeovers via SMS account-recovery flaw
Between March and May 2021 attackers used phished credentials and a flaw in Coinbase's SMS account-recovery process to take over about 6,000 customer accounts and withdraw funds. The total stolen was not disclosed.
Repaid — company's word onlyCoinbase told affected customers it would reimburse them; press repeated the company's statement but no independent tally of payouts exists.Regulatory
CFTC settlement over misleading trading-volume reporting
Coinbase paid $6.5m to settle CFTC claims that it reported misleading information about its trading volumes.
No funds at stakeRegulatory penalty; no customer funds at stake.
In our ratings
This page is the record. The scores sit on the review cards, next to the evidence and the weights they came from.
Compare Coinbase with
KrakenCentralised exchange · 2011 · United StatesSan Francisco crypto exchange run by Payward, Inc. since 2011. In March 2026 its Wyoming bank arm became the first crypto firm with a Fed master account.
GeminiCentralised exchange · 2014 · United StatesGemini is the Winklevoss twins' New York crypto exchange, custodian and card issuer, run under a NYDFS trust charter and listed on Nasdaq as GEMI since 2025.
BitstampCentralised exchange · 2011 · LuxembourgCrypto exchange founded in Slovenia in 2011 and based in Luxembourg. Robinhood bought it for $200m in June 2025; it runs Robinhood's UK crypto trading.
BinanceCentralised exchange · 2017The largest crypto exchange by volume, founded in 2017 by Changpeng Zhao. It pleaded guilty to US AML charges in 2023; Binance.US is a separate company.
Our coverage of Coinbase
- NewsBitcoin Surges Toward $85,000 as SEC Prepares to Open Tokenized Stock Pilot
- NewsUS Crypto Week: Treasury Sanctions BitBank as Coinbase Brings Crypto to Community Banks
- NewsUS Regulators and Congress Move in Tandem: SEC's Tokenized Stock Framework and House Crypto Bills Lift the Market
- NewsBitcoin Steadies Above $76K as the Fed Hikes Rates While Congress Splits on Crypto Legislation
- NewsBitcoin Slides Toward $76K as CLARITY Act Stalls in the Senate Ahead of the Fed's Rate Call
- NewsUS Crypto Market Rebounds Past $2.7 Trillion as Revolut Discloses Bitcoin Holder Data in Security Lapse
- NewsBitcoin Slides Below $77K as Hot Inflation Data Hits Markets Ahead of Senate's Crypto Vote
- NewsBitcoin Surges Past $81,000 as Fed Fears Ease — While a Major Trezor Breach Hits U.S. Users
Frequently asked questions
Is Coinbase a stock I can buy?+
Yes. Coinbase Global trades on Nasdaq as COIN and has been in the S&P 500 since 19 May 2025. Buying the stock gives you a share of the company. It is not the same as holding crypto, and we don't track the share price.
How do I withdraw money from Coinbase to my bank?+
Sell to cash, then choose Withdraw and pick a linked bank. In the US, ACH is free and a wire costs $25. Coinbase never needs you to call a number or quote a code to complete a withdrawal you started yourself.
Is Coinbase Wallet safe?+
Coinbase Wallet is a self-custody app, separate from your exchange account. The keys live on your device, so Coinbase can't freeze or recover them. It is as safe as your recovery phrase: anyone who asks for that phrase, including a caller who says they are from Coinbase, is stealing.
What happened to Coinbase Pro fees?+
Coinbase Pro was folded into Coinbase Advanced, which kept the maker/taker model. Since 16 September 2026 the US entry tier is 0.50% maker and 0.90% taker, with discounts starting at $10,000 of 30-day volume.
What is Coinbase One?+
A subscription from $4.99 to $299.99 a month that waives trading fees up to a monthly volume cap and lowers the staking commission. The spread on simple trades still applies.
Was Coinbase hacked in 2025?+
Its wallets weren't breached. Customer data was: bribed support contractors leaked records on fewer than 1% of monthly users, and scammers used them to phone customers. Coinbase put the cost at $180m–$400m, including reimbursing people who were tricked into sending funds.
What changed
- Profile published.
Compiled by
By Emily Volker
Editor-in-Chief · September 27, 2026
We have no commercial relationship with Coinbase and earn nothing from any link on this page. Every fact above carries the date it was true and a link to where it comes from; if one is out of date, the contact page reaches the editor who keeps this file.