Coinbase: Bitcoin Custodian and Exchange Operator

Coinbase plays three roles in bitcoin at once. It is the largest crypto exchange in the US, it holds the bitcoin of most US spot ETFs, and it keeps bitcoin of its own in the corporate treasury. As a result, more than a million bitcoin sit in funds that name Coinbase as their custodian. For you this means: Coinbase is a convenient way in, but not a place to leave your long-term reserve.

Coinbase at a glance

Coinbase was founded in San Francisco in 2012 and was one of the first companies where ordinary people could buy bitcoin with a bank account and a credit card. Today it is a group with several businesses, all of which depend on bitcoin and other crypto assets.

Joining the S&P 500 sent a signal: a company that lives from trading crypto assets now belongs to the 500 large US companies that many index funds buy automatically. If you own a broad US equity ETF, you also own a small piece of Coinbase.

Role 1: The exchange

As an exchange, Coinbase brings buyers and sellers together and earns from fees and from the gap between the buying and selling price. Retail customers get the simple app, professionals and companies have their own trading venues.

What matters is what happens to your bitcoin after you buy. As long as they sit in your Coinbase account, the keys belong to Coinbase. You have a claim against the company, not the coins themselves. The bitcoin of many customers sit together in the exchange's wallets; the number in your account is an entry in Coinbase's books.

Coinbase has described this openly. Its quarterly report for the first quarter of 2022 listed as a risk that customer assets held in custody could be counted as part of the estate in a bankruptcy, leaving customers as general creditors. CEO Brian Armstrong then wrote that the risk was small and that Coinbase was not in danger. The sentence was there all the same, because the law was not clear at the time.

How such cases play out in practice, from Mt. Gox to FTX, is shown in the article Crypto exchange bankrupt. Coinbase is not FTX: it is publicly listed, files audited reports with the US Securities and Exchange Commission (SEC) and is supervised in several countries. But even a solid exchange remains a third party between you and your bitcoin.

Role 2: The custodian of the US bitcoin ETFs

Since January 2024 the US has had spot ETFs, funds that buy real bitcoin and store them. What they mean for investors is explained in the article Bitcoin spot ETFs. Here the question is where the coins are.

Almost all issuers chose Coinbase for this. Only Fidelity holds its coins with its own affiliate. For some funds Coinbase is the only custodian, for others it shares the task with Anchorage Digital, BitGo, Gemini or BNY.

The holdings come from the issuers' own figures, mostly from 8 to 10 Nov 2026, for BTCO from 30 Sep 2026 and for BTCW and MSBT from 30 Jun 2026. Not in the table: Fidelity's FBTC with its own custody, and ARKB, for which our data holds no custodian. Who holds how much and when money flowed is shown in the article Bitcoin ETF flows and holdings.

What a custodian actually does

The custodian creates and guards the keys to the fund's bitcoin. The coins sit in their own wallets, separate from everything else, mostly offline in so-called cold storage. Moving them takes several people and approvals. Bitwise even publishes its fund's addresses, so anyone can check on the blockchain that the bitcoin are there.

For many funds Coinbase is also the trading partner through which the fund buys and sells bitcoin. Exchange and custodian then sit in the same group.

Role 3: Its own bitcoin

Separately from customer funds, Coinbase holds bitcoin as an investment of its own. According to its quarterly report to the SEC, it held 17’954 BTC on 30 Sep 2026. The company buys more regularly.

That is why Coinbase is not a bitcoin treasury company like Strategy. At Strategy, the bitcoin holdings drive almost all of the share price. At Coinbase, trading volume, fees and interest income drive it. You can see this in the mNAV, the ratio of market value to bitcoin value: Coinbase comes to about 27 times the value of its bitcoin. What this figure means and when it tells you something is explained in mNAV explained. Coinbase also appears with its holdings in our treasury list.

There is also a third pot: cbBTC, a token Coinbase issues on other blockchains and backs with real bitcoin. According to Coinbase's own proof of reserves, about 97’880 BTC stood behind it on 10 Nov 2026. These bitcoin belong economically to the token holders, not to Coinbase.

The concentration risk: many bitcoin, one key holder

Bitcoin was built so that nobody has to trust a central party. With the ETFs it is the other way round: a large share of the fund bitcoin depends on one company. This does not endanger the bitcoin network. Coinbase cannot change rules, create bitcoin or block other people's transactions. It does endanger the investors who hold through this company.

What can go wrong at a single custodian:

• Theft: an attack on the keys, from outside or with help from inside.
• Mistakes: a wrong transfer, a lost backup, a software bug.
• State access: a US court or authority can order a custodian to freeze or hand over bitcoin. With your own keys that is not so simple.
• Outage: if Coinbase is unreachable for a day, many funds cannot move bitcoin.

The issuers know this. That is why BlackRock, Grayscale and others added a second custodian after launch. A replacement is ready, but the problem does not disappear: as long as most of the coins sit in one place, that place is a target.

The 2025 data leak

In May 2025 Coinbase disclosed that criminals had bribed staff of an external support contractor abroad. They passed on customer data: names, addresses, phone numbers, email addresses, images of ID documents, parts of account numbers and balances. Passwords, access keys and the bitcoin themselves were not affected. According to Coinbase, fewer than 1% of monthly users were hit; according to a filing with the authorities, 69’461 customers.

The criminals demanded a $20 million ransom. Coinbase did not pay. Instead it offered a reward of the same amount for information leading to the perpetrators and announced that it would reimburse customers who were defrauded with the stolen data. Coinbase estimated the cost of this in the hundreds of millions of dollars.

With the data, fraudsters called customers, posed as Coinbase support and talked them into sending their coins to a supposedly safe account. The pattern is typical and can hit anyone whose data is stored somewhere. How to recognise such calls is shown in the article Social engineering.

What this means for you in Germany, Austria and Switzerland

Coinbase also offers its app in the DACH region. As of November 2026 Coinbase serves customers in the EU under the European crypto regulation MiCA, with a licence from Luxembourg. Since July 2026 MiCA applies without transition periods. Providers must keep customer coins legally separate from their own assets. MiCA does not apply in Switzerland. Check the terms to see which Coinbase company your contract is with, because that decides which law applies if something goes wrong.

For you as a long-term holder this leads to three simple rules:

1. Buy, yes; leave it there, no. Use Coinbase or another exchange to buy, then withdraw the bitcoin to your own wallet. How to store them safely there is shown in the complete custody guide.
2. An ETF means: Coinbase holds your bitcoin. If you buy a US ETF or a European product with Coinbase Custody as custodian, you depend on the same custodian, just with a fund in between.
3. Your data is reported. Since 1 Jan 2026, crypto providers in the EU collect customer data and transactions for the tax authorities (DAC8); the first report follows in 2027. That is no problem if you pay your taxes properly, but it is one more reason to be discreet with your data.

In Germany the location does not change the tax: bitcoin you hold for more than a year can be sold tax-free, whether they sit at Coinbase or in your wallet. Withdrawing to your own wallet is not a sale.