Coinbase

If you have just received an SMS saying a withdrawal code was requested and you did not request it, treat your password as already stolen and change it immediately — from the app you open yourself, never from a link in the message. The reason is the part most warnings get wrong: the code is genuine. Coinbase really sent it, because someone really did try to log in as you, using a password they already have.

That changes what the right response is. This is not spam to ignore. A real code arriving unrequested is evidence that the first half of the attack already worked, and the only thing still standing between an attacker and your balance is the second factor they are now trying to talk you out of.

The message usually offers a way to "cancel" the withdrawal — a link, or a number to call. The link leads to a page identical to the real Coinbase login; entering your details there hands over the code and the account empties within minutes. The callback variant puts you on the phone with someone posing as support who will ask for exactly the information that completes the theft. Individual losses run into five and six figures, and sheriff’s offices in several US counties have issued public alerts about this specific campaign.

What to do, in order: open the Coinbase app directly and change your password; check and re-secure your two-factor method, preferring an authenticator app or hardware key over SMS; review recent account activity and linked devices. Then report it — forward a screenshot to Coinbase’s security address and mark the text as junk. Do not call any number in the message, and do not reply to it.

One rule covers every version of this: Coinbase does not send unsolicited withdrawal codes, and no legitimate Coinbase process ever begins with a text telling you to click a link to stop something. If a message creates urgency about your money, the urgency is the attack.

A $10,000 bitcoin buy cost 0.60% when we priced it on 14 July 2026 — the most expensive venue in our rating, 2.3 times Kraken and six times Binance for the identical order. The published taker fee is effectively the whole bill at that size, and the whole bill is high.

The simple buy-and-sell screen most people use costs more again. Our 0.60% is the Advanced Trade taker rate; the instant-buy interface applies a spread plus a flat or percentage fee on top, and someone comparing exchanges from that screen is reading a materially worse number than the one above. Same company, same custody, different price for the same bitcoin.

Depth is the other half, and this is where the measurement surprised us. We found 28.2 BTC within 0.1% of best ask against Kraken’s 189.8 — roughly a seventh of the book at the level that decides whether a large order moves the price. It recovers further out: 330.0 BTC within 0.5%, which is comparable. So for retail size the thin top of book barely matters, and for institutional size it does.

One measurement goes the other way. Coinbase returned the fastest API responses in the run at 183 ms, ahead of Kraken’s 224 ms and Binance’s 460 ms, and its documentation and status reporting are the best in the category. That is worth something to a developer and nothing to someone buying once a month.

The honest summary is that you are paying roughly 34 basis points over Kraken for a listed, audited, US-regulated counterparty and the smoothest onboarding in crypto. Whether that is worth it is a real question with a defensible answer either way. It is not a cheap place to trade, and no retail volume tier makes it one.

Coinbase is the most heavily regulated venue in our rating and the one that gives you the least ability to check its reserves yourself. Both halves of that are true simultaneously, and which matters more depends on what you think "safe" means.

The evidence it does offer is institutional rather than cryptographic: a Nasdaq listing since April 2021, accounts and internal controls audited annually by a major firm, SEC filings, and licences in all 50 US states, the EEA via a Luxembourg MiCA authorisation, and the UK via the FCA register. We found no documented breach of customer crypto in fourteen years. That is a genuinely strong record.

What it does not publish is any proof of reserves — no Merkle tree, no reserve addresses, no way for you to confirm your balance is backed. Every other large venue we rate publishes something, even where that something turned out to be an empty table. Coinbase’s position is that an audited balance sheet is stronger evidence than a self-run proof, and there is a real argument there. It is also evidence you have to take on trust rather than check.

The sharpest warnings about Coinbase are the ones Coinbase writes about itself. Its annual report states that total customer assets are substantially more than its corporate assets and available insurance. A standing risk factor says that in a bankruptcy, custodially held crypto could be drawn into the estate and customers treated as general unsecured creditors. That is the company telling you, in a document it is legally obliged to be accurate in, that your coins may not be ring-fenced from its own failure.

We score its custody 8 out of 10 — second only to venues with attested, liability-inclusive proofs — and the deduction is precisely for the missing proof. The practical conclusion is the one that applies everywhere: an exchange balance is a claim on a company, and this company has told you in writing what that claim ranks as if things go wrong.