Exchange record All ledgers
Coinbase: its public record
Coinbase’s public record: a MiCA authorisation, New York licences, a Dubai licence via Deribit, 1 hack ($300,000) and 4 US enforcement documents naming it.
Coinbase holds a MiCA authorisation in the EU through Luxembourg, first granted on 20 June 2025. New York’s financial regulator lists Coinbase, Inc. (Virtual Currency and Money Transmitter Licenses, 2017-01) and Coinbase Custody Trust Company, LLC (Limited Purpose Trust Charter, 2018-10). In Dubai, the Virtual Assets Regulatory Authority lists Deribit FZE (Deribit, which Coinbase finished acquiring in 2025) as licensed, from 1 November 2024. The hacks ledger records 1 hack of the company itself with a known loss, $300,000 in all, on 13 August 2025. 4 US enforcement documents name it in the title, the latest from the SEC on 27 February 2025 (“The SEC filed a joint stipulation to dismiss its civil enforcement action against Coinbase, citing the work of its Crypto Task Force”), and 1 more mentions it. Its parent reported a material cybersecurity incident to the SEC on 15 May 2025 (Form 8-K, Item 1.05).
Licences
| Firm | Country | Regulator | From | Basis |
|---|---|---|---|---|
| Coinbase Luxembourg S.A. trading as Coinbase | Luxembourg | Commission de Surveillance du Secteur Financier (CSSF) | 20 Jun 2025 | Authorised |
New York: Coinbase Custody Trust Company, LLC, Limited Purpose Trust Charter, 2018-10; Coinbase, Inc., Virtual Currency and Money Transmitter Licenses, 2017-01. Source: NYDFS.
Dubai: Deribit FZE (Deribit, which Coinbase finished acquiring in 2025), VASP Licence VL/23/12/002, from 01 Nov 2024 (Exchange Services (including Exchange Traded Derivative Services); Broker-Dealer Services). Source: VARA public register · every Dubai licence.
Hacks of the company itself
| Date | Target | Lost | Type | Method | Returned or repaid |
|---|---|---|---|---|---|
| 13 Aug 2025 | Coinbase | $300,000 | CEX | Token Approval Abuse | — |
From the hacks ledger, which follows DefiLlama’s records of incidents with a known loss. Hacks of a brand’s separate DeFi products, takeovers of its social media accounts and abnormal-trading incidents classed as market manipulation aren’t counted here.
What the company has told the SEC
- 15 May 2025, Form 8-K, Item 1.05 (material cybersecurity incident). Coinbase reported that a threat actor appears to have paid contractors or employees in support roles outside the US to take customer data from internal systems, then demanded money not to publish it. Coinbase said it had not paid. The data included names, addresses, masked bank and Social Security numbers, government ID images and account balances. Coinbase gave a preliminary estimate of about $180 million to $400 million for remediation and for voluntarily reimbursing eligible retail customers who had sent funds to the attacker, and said the figure could increase or decrease. In its words: “The Incident did not involve the compromise of passwords or private keys, and at no time were any of the targeted contractors or employees able to access customer funds.”
Listed US companies must report a material cybersecurity incident on Form 8-K, Item 1.05, within four business days of deciding it is material. The rule took effect in December 2023, and companies decide for themselves what is material. Checked against the company’s EDGAR filings on every desk run.
US enforcement documents naming it
| Date | Agency | Step | What the document says |
|---|---|---|---|
| 27 Feb 2025 | SEC | Dismissal | The SEC filed a joint stipulation to dismiss its civil enforcement action against Coinbase, citing the work of its Crypto Task Force. |
| 06 Jun 2023 | SEC | Civil action | SEC sued Coinbase, alleging it operated as an unregistered exchange, broker and clearing agency and sold unregistered staking services. Later: The SEC filed a joint stipulation to dismiss this action on 27 February 2025. SEC press release 2025-47 |
| 04 Jan 2023 | NYDFS | Settlement | NYDFS issued a consent order to Coinbase over deficiencies in its anti-money laundering and sanctions compliance program, with a $50 million civil monetary penalty. |
| 19 Mar 2021 | CFTC | Settlement | CFTC settled charges ordering Coinbase to pay $6.5 million for inaccurate trade reporting and a former employee's wash trading. |
Documents that name Coinbase in the title. Charges are allegations unless a plea, conviction or settlement is stated, and a later document can change the outcome. 1 more document mentions it without naming it in the title. See every document in the company check.
On Bitminer.io
What this record can’t tell you
This is the public record, not a safety rating or advice. It can’t show how a company holds customers’ money today, whether it is solvent, how it treats complaints, or cases outside the US. The enforcement ledger is complete from January 2024 and holds only some earlier documents. Matching is by name, so a firm with another name can be missed, and a record can lag the latest events. Every figure comes from the ledgers, each with its source: all 27 exchanges and apps compared.
Cite this Bitminer.io, “Coinbase: its public record”, data to 6 November 2026, https://bitminer.io/ledger/exchange/coinbase/. Free to reuse under CC BY 4.0 with credit and a link. How this is built · Frozen copy of November 2026’s data