Is Coinbase Wallet safe to connect?
Self-custody wallet ยท Base, Ethereum, Bitcoin, Solana, BNB Chain, Optimism, Arbitrum, Polygon, Avalanche, Monad, Robinhood Chain. Checked 2026-10-25; every line links its source.
Worst case: Coinbase Wallet is self-custody, so if you import a recovery phrase someone gave you (a known Coinbase-impersonation trick), leak your own phrase, or sign a malicious approval, the funds can be taken. Coinbase the exchange can't reverse it.
Safe setup in 3 steps
- Install only via wallet.coinbase.com or help.coinbase.com: Chrome Web Store ID hnfanknocfeofbddgcijnmhnfnkdnaad, App Store id1278383455, Google Play org.toshi. There's no Firefox add-on.
- Never import a recovery phrase you didn't create yourself. Coinbase never sends you one, and any 'migration' email or call from 'Coinbase support' asking you to move funds is a scam.
- Keep bot and dapp funds in a separate wallet with a small balance, and revoke stale approvals at Revoke.cash.
What it can do with your money
| Who holds the keys | You hold the keys 'A Coinbase wallet is a self-custody wallet': private keys are 'stored directly on your mobile device and not with a centralized exchange like Coinbase'. Newer smart-wallet 'Base accounts' can sign in with an email one-time code, a passkey or a recovery phrase (https://help.coinbase.com/en/wallet/getting-started/smart-wallet-passkeys). The help page doesn't say where key material for email sign-in is held. source |
|---|---|
| Can funds be sent out to any address? | Yes. You sign sends yourself. Some features are geo-restricted (The Block, 2026-09-10). source |
| Swaps and third parties | In-app swaps go through third-party DEX aggregators, which 'may charge a fee', plus a fee of 'up to 1% on swaps'. Perpetual futures in the app are routed through Hyperliquid (The Block, 2026-09-10). source |
Official links
- Website:
wallet.coinbase.com - App:
https://chromewebstore.google.com/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad - App:
https://apps.apple.com/us/app/coinbase-wallet-trade-to-win/id1278383455 - App:
https://play.google.com/store/apps/details?id=org.toshi
Where we confirmed these
Deadlines
- 2026-08-15: PASSED: Dogecoin, Litecoin, zkSync Era and other networks are no longer supported in Coinbase Wallet. Those assets are still on-chain: import your recovery phrase into another wallet to reach them. source
Incidents
| Date | What happened | Amount | Outcome | Source |
|---|---|---|---|---|
| 2025-07-03 | Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Coinbase, MetaMask, Phantom, Trust Wallet, Exodus and others. Coinbase Wallet has no official Firefox add-on (third-party report). | reported to Mozilla | source | |
| 2025-03-18 | 'Migrate to Coinbase wallet' phishing emails gave each recipient a pre-generated 'recovery phrase' and told them to import it into the real Coinbase Wallet app. The scammers already knew the phrase and drained whatever was moved in (Bitdefender, third-party report). | warning | source |