# Is Coinbase Advanced safe to connect? | TradingAgentStack

> Coinbase Advanced: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-24.

Canonical: https://tradingagentstack.com/check/coinbase-advanced/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Coinbase Advanced

# Is Coinbase Advanced safe to connect?

Exchange · Multi-asset centralized exchange (Coinbase's advanced trading interface). Checked 2026-10-24; every line links its source.

**Worst case:** Coinbase holds your coins and can restrict your account at its sole discretion; an API key with 'transfer' permission that leaks lets the holder send everything out, and leaked customer data fuels fake-support scams.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Create CDP keys with view (and trade if needed) only; never give 'transfer' to a bot

2. Add your server's IP to the key's allowlist, even though Coinbase doesn't require it

3. Treat any call or message from 'Coinbase support' as a scam; Coinbase staff never ask you to move funds

Coinbase Advanced also has a full listing with an Agent Risk Score [Agent risk 72% (partial, 6 of 7 inputs)](https://tradingagentstack.com/methodology/#agent-risk-score): [Coinbase Advanced on TradingAgentStack](https://tradingagentstack.com/tool/coinbase-advanced/).

## What it can do with your money

| Who holds the keys | The exchange holds your funds Custodial; Coinbase says it will not use customer funds for operating expenses (User Agreement §2.8). [source](https://www.coinbase.com/legal/user_agreement/united_states) |
| --- | --- |
| Can funds be sent out to any address? | Yes. Sends/withdrawals available; Coinbase may suspend sending of digital assets (§1.2) and may impose waiting periods after transactions (§4.4). [source](https://www.coinbase.com/legal/user_agreement/united_states) |
| Can it hold or freeze your funds? | US User Agreement: Coinbase may 'suspend, restrict, or terminate your access' with immediate effect 'for any reason at its sole discretion' and need not explain (§6.10); may cancel or reverse transactions if it suspects financial crime (§3.8); may require additional information and Enhanced Due Diligence (§1.3, Appendix 1); may require you to wait after a transaction (§4.4). After deactivation you have 90 days to transfer funds unless legally prohibited (§6.10). No fixed review duration is stated. [source](https://www.coinbase.com/legal/user_agreement/united_states) |
| What a leaked API key can do | CDP API keys carry view, trade and/or transfer permissions. Coinbase warns that if a key can transfer, whoever holds it 'will be able to send all the digital currency out of your account'. IP allowlist is 'recommended but not required'. ECDSA signature algorithm is required for Coinbase App/Advanced APIs. Key expiry is not stated. [source](https://docs.cdp.coinbase.com/coinbase-app/authentication-authorization/api-key-authentication) |
| Monero and Zcash | **XMR**: not listed **ZEC**: trade+deposit+withdraw (ZEC-USD online; ZEC on Zcash and Base networks per Coinbase Exchange API on 2026-10-24) [source](https://api.exchange.coinbase.com/currencies/ZEC) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `coinbase.com`

Where we confirmed these
- https://www.coinbase.com/legal/user_agreement/united_states (Coinbase User Agreement)

- https://docs.cdp.coinbase.com/coinbase-app/advanced-trade-apis/rest-scopes.md (official API docs; keys created at portal.cdp.coinbase.com)

- https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm (Coinbase Global 8-K)

## Deadlines

- **2027-07-10**: EU AMLR (Regulation (EU) 2024/1624, Art. 79(1)) applies: crypto-asset service providers may not keep accounts that allow anonymisation or obfuscation of transactions, including through anonymity-enhancing coins (e.g. XMR, ZEC). Relevant if you use an EU/EEA-licensed entity of this service. [source](https://didit.me/blog/privacy-coins-no-kyc-swaps-rules-2026/)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2025-05-11 | Customer data breach: bribed overseas support staff leaked names, addresses, ID images, masked SSNs and balances; attacker demanded ransom; data used for impersonation scams | $180M-$400M estimated remediation and reimbursement cost | Coinbase said no passwords or private keys were compromised and it would reimburse eligible retail customers tricked into sending funds | [source](https://www.sec.gov/Archives/edgar/data/1679788/000167978825000094/coin-20250514.htm) |

## Check a link

Got a link, @handle or repo that claims to be Coinbase Advanced? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Coinbase Advanced

We email you if we add an incident, a freeze report, a known fake or a deadline for Coinbase Advanced. Free; unsubscribe anytime.

## More checks: Exchanges
[Binance](https://tradingagentstack.com/check/binance/)[Bybit](https://tradingagentstack.com/check/bybit/)[OKX](https://tradingagentstack.com/check/okx/)[Kraken](https://tradingagentstack.com/check/kraken/)[Hyperliquid](https://tradingagentstack.com/check/hyperliquid/)[Bitget](https://tradingagentstack.com/check/bitget/)[Gemini](https://tradingagentstack.com/check/gemini/)[KuCoin](https://tradingagentstack.com/check/kucoin/)[MEXC](https://tradingagentstack.com/check/mexc/)[Gate](https://tradingagentstack.com/check/gate/)[HTX](https://tradingagentstack.com/check/htx/)[Crypto.com Exchange](https://tradingagentstack.com/check/crypto-com-exchange/)[BingX](https://tradingagentstack.com/check/bingx/)[Bitfinex](https://tradingagentstack.com/check/bitfinex/)[Bitvavo](https://tradingagentstack.com/check/bitvavo/)[Bitstamp](https://tradingagentstack.com/check/bitstamp/)[WhiteBIT](https://tradingagentstack.com/check/whitebit/)[Pionex](https://tradingagentstack.com/check/pionex/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)