# Is Coinbase Wallet safe to connect? | TradingAgentStack

> Coinbase Wallet: worst case for your money, official links, freeze and key risks, incidents and a 3-step safe setup. Sourced, checked 2026-10-25.

Canonical: https://tradingagentstack.com/check/coinbase-wallet/

1. [Home](https://tradingagentstack.com/)

2. [Check](https://tradingagentstack.com/check/)

3. Coinbase Wallet

# Is Coinbase Wallet safe to connect?

Self-custody wallet · Base, Ethereum, Bitcoin, Solana, BNB Chain, Optimism, Arbitrum, Polygon, Avalanche, Monad, Robinhood Chain. Checked 2026-10-25; every line links its source.

**Worst case:** Coinbase Wallet is self-custody, so if you import a recovery phrase someone gave you (a known Coinbase-impersonation trick), leak your own phrase, or sign a malicious approval, the funds can be taken. Coinbase the exchange can't reverse it.

Already lost funds? [What to do if a bot or wallet is drained](https://tradingagentstack.com/trading-bot-drained-what-to-do/).

## Safe setup in 3 steps

1. Install only via wallet.coinbase.com or help.coinbase.com: Chrome Web Store ID hnfanknocfeofbddgcijnmhnfnkdnaad, App Store id1278383455, Google Play org.toshi. There's no Firefox add-on.

2. Never import a recovery phrase you didn't create yourself. Coinbase never sends you one, and any 'migration' email or call from 'Coinbase support' asking you to move funds is a scam.

3. Keep bot and dapp funds in a separate wallet with a small balance, and revoke stale approvals at Revoke.cash.

## What it can do with your money

| Who holds the keys | You hold the keys 'A Coinbase wallet is a self-custody wallet': private keys are 'stored directly on your mobile device and not with a centralized exchange like Coinbase'. Newer smart-wallet 'Base accounts' can sign in with an email one-time code, a passkey or a recovery phrase (https://help.coinbase.com/en/wallet/getting-started/smart-wallet-passkeys). The help page doesn't say where key material for email sign-in is held. [source](https://help.coinbase.com/en/wallet/getting-started/what-is-coinbase-wallet) |
| --- | --- |
| Can funds be sent out to any address? | Yes. You sign sends yourself. Some features are geo-restricted (The Block, 2026-09-10). [source](https://help.coinbase.com/en/wallet/getting-started/what-is-coinbase-wallet) |
| Swaps and third parties | In-app swaps go through third-party DEX aggregators, which 'may charge a fee', plus a fee of 'up to 1% on swaps'. Perpetual futures in the app are routed through Hyperliquid (The Block, 2026-09-10). [source](https://help.coinbase.com/en-au/wallet/getting-started/dex-swap) |

## Official links

Each link below was confirmed from at least two independent places (the vendor's own pages plus another source). Anything else using this name is not on the list.

- Website: `wallet.coinbase.com`

- App: `https://chromewebstore.google.com/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad`

- App: `https://apps.apple.com/us/app/coinbase-wallet-trade-to-win/id1278383455`

- App: `https://play.google.com/store/apps/details?id=org.toshi`

Where we confirmed these
- https://help.coinbase.com/en/wallet/browser-extension/coinbase-wallet-extension (links Chrome Web Store hnfanknocfeofbddgcijnmhnfnkdnaad and wallet.coinbase.com)

- https://chromewebstore.google.com/detail/coinbase-wallet-extension/hnfanknocfeofbddgcijnmhnfnkdnaad (publisher Toshi Holdings Pte. Ltd, website wallet.coinbase.com, 'Created by the owner of the listed website', 1,000,000 users, v3.150.0 updated 2026-10-19)

- https://wallet.coinbase.com/ (coinbase.com/wallet redirects here; apple-itunes-app meta app-id=1278383455)

- https://apps.apple.com/us/app/coinbase-wallet-trade-to-win/id1278383455 (seller Coinbase Wallet, developer website wallet.coinbase.com, v30.17)

- https://www.coinbase.com/wallet/downloads (Android 'Download Now' via go.cb-w.com/wallet-mobile-download redirects to Google Play org.toshi)

- https://play.google.com/store/apps/details?id=org.toshi (title 'Coinbase Wallet: Trade to Win', developer Coinbase Wallet, website wallet.coinbase.com, updated 2026-10-16)

## Deadlines

- **2026-08-15**: PASSED: Dogecoin, Litecoin, zkSync Era and other networks are no longer supported in Coinbase Wallet. Those assets are still on-chain: import your recovery phrase into another wallet to reach them. [source](https://help.coinbase.com/en/wallet/getting-started/get-started)

## Incidents

Items marked "reported by users" are claims we could not confirm with the vendor or a security firm.

| Date | What happened | Amount | Outcome | Source |
| --- | --- | --- | --- | --- |
| 2025-07-03 | Koi Security found 40+ fake wallet add-ons on the Firefox store impersonating Coinbase, MetaMask, Phantom, Trust Wallet, Exodus and others. Coinbase Wallet has no official Firefox add-on (third-party report). (third-party report) |  | reported to Mozilla | [source](https://thehackernews.com/2025/07/over-40-malicious-firefox-extensions.html) |
| 2025-03-18 | 'Migrate to Coinbase wallet' phishing emails gave each recipient a pre-generated 'recovery phrase' and told them to import it into the real Coinbase Wallet app. The scammers already knew the phrase and drained whatever was moved in (Bitdefender, third-party report). (third-party report) |  | warning | [source](https://www.bitdefender.com/en-us/blog/hotforsecurity/mandatory-coinbase-wallet-migration-its-a-phishing-scam) |

## Check a link

Got a link, @handle or repo that claims to be Coinbase Wallet? Paste it to see if it's on the official list.

Checking links inside Telegram? Send them to [@TASCheckBot](https://t.me/TASCheckBot), or add it to your group so anyone can type `/check`. Alerts on new drains and fakes: [@tradingAgentStk](https://x.com/tradingAgentStk).

## Get an alert for Coinbase Wallet

We email you if we add an incident, a freeze report, a known fake or a deadline for Coinbase Wallet. Free; unsubscribe anytime.

## More checks: Wallets
[Phantom](https://tradingagentstack.com/check/phantom/)[MetaMask](https://tradingagentstack.com/check/metamask/)[Rabby Wallet](https://tradingagentstack.com/check/rabby/)[Trust Wallet](https://tradingagentstack.com/check/trust-wallet/)[Exodus](https://tradingagentstack.com/check/exodus/)[Backpack](https://tradingagentstack.com/check/backpack/)[Solflare](https://tradingagentstack.com/check/solflare/)[Electrum](https://tradingagentstack.com/check/electrum/)[Keystone](https://tradingagentstack.com/check/keystone/)

Something wrong or out of date? [Send a correction](https://tradingagentstack.com/submit/) with a link to the vendor's docs. Not financial advice. [How we check](https://tradingagentstack.com/check/#method).

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)