Coinbase scams: how the impersonation calls work, and what Coinbase says it will never ask
Most Coinbase scams are impersonation: a caller or text posing as Coinbase support pushes the customer to move coins to a "safe" wallet. Coinbase's help centre lists what its staff never ask for. In May 2025 Coinbase disclosed that bribed support contractors had taken customer data, including government ID images, for under 1% of monthly transacting users, which gave scammers real details to quote.
A Coinbase scam is usually a phone call, text or email from someone posing as Coinbase support who persuades the customer to move coins to an address the caller controls. Coinbase's help centre says its staff will never ask a customer to "secure, move, or access your funds", never ask for a password or 2-step code, and never supply a new seed phrase. In May 2025 Coinbase disclosed that bribed support contractors had copied data for under 1% of its monthly transacting users, the raw material for convincing calls.
Coinbase's help centre, its May 2025 blog post and its Form 8-K were read on 14 October 2026. The Coinbase register entry, with its terms and freeze clauses, is at Coinbase.
How do Coinbase impersonation scams work?
The help centre describes the pattern in its own words. "Technical support scammers set up fake customer support phone lines and impersonate companies", and they also pose as regulators, government agencies and law enforcement. "Scammers can spoof legitimate phone numbers when conducting outbound calls", so a caller ID showing a real Coinbase number proves nothing.
The usual sequence: a text or call claims an unauthorised login or a suspicious withdrawal. The caller already knows the customer's name, address and balance. They say the account is compromised and the coins must go to a new "safe" wallet, or that the customer must install software so support can help. The coins move, on-chain, and the call ends. Once the coins sit at an outside address, they are controlled by whoever holds that address's keys, not by Coinbase.
The help centre also names a variant aimed at people who already feel exposed, citing Argentina's securities regulator: scammers impersonating Coinbase "to offer fake insurance products", such as a "Premium Insurance Policy" or "Cryptocurrency Insurance". The page states that Coinbase does not offer insurance products.
What does Coinbase say it will never ask?
The help centre list, verbatim where quoted:
| Request | Coinbase's statement |
|---|---|
| Move or secure funds | Never asks you to "secure, move, or access your funds" |
| Seed phrase | Never provides one or asks for yours |
| Password or 2FA code | Never asks for either |
| Install software | Never asks you to install software |
| Remote access | Never remotely accesses your device |
| Unknown phone number | Never asks you to contact one |
| Send crypto out | Never asks you to send crypto to external addresses |
The May 2025 blog post repeated the core rule after the data theft:
Coinbase will never ask for your password, 2FA codes, or to move funds to a "safe" wallet.
and: "We will never call or text you to give you a new seed phrase or wallet address to move your funds to." Its instruction for anyone who gets that call: "If you receive this call, hang up the phone."
One exception is worth knowing, because scammers can mimic it. The help centre says that if a real support call drops, "the agent will call you back within five minutes" on the same number, after reverifying identity with a security question. A callback that asks for funds to move is still a scam under Coinbase's own list.
What was the May 2025 Coinbase data theft?
On 11 May 2025 Coinbase received an email from a threat actor claiming to hold customer data. Its 8-K, filed 15 May 2025, says the actor had paid "multiple contractors or employees working in support roles outside the United States" to pull it. The data included names, addresses, phone numbers and emails, the last four digits of Social Security numbers, masked bank account numbers, "Government-ID images (e.g., driver's license, passport)" and "Account data (balance snapshots and transaction history)".
What was not taken, per the filing: "The Incident did not involve the compromise of passwords or private keys." The blog post put the scope at "less than 1% of Coinbase monthly transacting users" and said the attackers "tried to extort Coinbase for $20 million". Coinbase refused and set up "a $20 million reward fund for information leading to the arrest and conviction of the attackers". The 8-K preliminarily estimated expenses at "approximately $180 million to $400 million", covering remediation and voluntarily reimbursing retail customers who sent funds to the attackers as a result. The exact count of affected customers was not verified from a primary source.
The point for a customer is simple. A caller who knows the balance and the last four digits of a Social Security number is not proving they work at Coinbase. That data was for sale.
What should a Coinbase customer do after a suspicious call?
Coinbase's help centre gives the steps. Hang up. "Lock first, ask later": lock the account in the app and email security@coinbase.com. Contact Coinbase only through the number or email on its own Contact Us page. Turn on withdrawal allow-listing so funds can only go to addresses already approved, and "Enable strong 2-factor authentication. Hardware keys are best." Coinbase's fee disclosures also list a 5% asset recovery fee on amounts over $100, which applies to recoveries Coinbase performs, not to theft.
If coins were already sent, the second wave usually follows. The FBI's July 2026 announcement warns of scammers who "promise to recover the victim's lost money", and states: "IC3 will never ask for payment to recover lost funds." The FTC: "Never pay upfront for a refund or help with a refund." The legitimate reporting routes are on the crypto scam recovery page. The same playbook targets self-custody users; see what is a seed phrase and pig butchering scams.
Quick answers
Does Coinbase ever call customers?
Coinbase says an agent will call back within five minutes if a support call it was already on drops. It says it will never call or text to request account access or to give a new wallet address.
Will Coinbase ask me to move my crypto to a safe wallet?
No. Its May 2025 post says Coinbase "will never ask for your password, 2FA codes, or to move funds to a "safe" wallet." See Coinbase safety.
Was Coinbase hacked in 2025?
Insiders were bribed for customer data affecting under 1% of monthly transacting users. The 8-K says no passwords or private keys were taken.
Can Coinbase reverse a scam transfer?
Once coins reach an outside address, the holder of that address's keys controls them. Report it to Coinbase and the authorities listed on the scam recovery page, and pay no one who offers to recover it.
Sources
- Coinbase Help Center, technical support and impersonation scams, retrieved 14 October 2026
- Coinbase blog, protecting our customers, standing up to extortionists, 15 May 2025, retrieved 14 October 2026
- Coinbase Global Form 8-K, 15 May 2025, retrieved 14 October 2026
- Coinbase pricing and fees disclosures, retrieved 14 October 2026
- Coinbase United States User Agreement, last updated 22 July 2026, retrieved 14 October 2026
- FBI public service announcement I-072026-PSA, FBI warns of scammers impersonating the IC3, 20 July 2026, retrieved 14 October 2026
- FTC consumer advice, refund and recovery scams, retrieved 14 October 2026
- CryptoGuardz crypto scam recovery page
- CryptoGuardz exchange register, Coinbase entry
About this piece
Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.