SQ-E01
ACCOUNT PRIVACY FILE
Coinbase
A custodial account whose entity, hosted-asset control and 2025 support-chain incident reveal where privacy and account security intersect.
- REVIEW DATE
- STATUS
- partially verified
- CONFIDENCE
- medium
Written by SignalQuoin Editorial TeamIndependently reviewed by SignalQuoin Review TeamPublished by SignalQuoin Team
EDITORIAL ASSESSMENT
Coinbase gives unusually strong corporate disclosure for a consumer crypto platform, but its account relationship necessarily links identity, funding and transaction records. The 2025 incident shows why outsourced support access belongs in a privacy review even when private keys were not exposed.
- Contracting and custody language is accessible
- SEC filings provide incident and cost updates
- Hosted custody and self-custody Wallet are separate products
- No SignalQuoin network-capture test has been performed
- Regional entities and protections vary
- Public disclosures do not enumerate every processor or retention path
CLAIM → EVIDENCE → LIMIT / 5
The privacy ledger
Identity boundary
- CLAIM UNDER REVIEW
- A Coinbase.com account is a custodial, identified relationship.
- EVIDENCE FOUND
- The US agreement names Coinbase, Inc. and sets account, compliance and service terms.
- DO NOT INFER
- The US agreement cannot establish the entity or data rules for every market.
Asset-control boundary
- CLAIM UNDER REVIEW
- Hosted-wallet keys are controlled by Coinbase, while Coinbase Wallet is a different self-custody product.
- EVIDENCE FOUND
- Coinbase's help material describes custody of supported customer assets.
- DO NOT INFER
- Custody wording does not prove insolvency treatment or universal insurance.
Sources: Coinbase User Agreement — United States ↗ · What Coinbase does with digital assets ↗
Support-chain exposure
- CLAIM UNDER REVIEW
- Personal data can be exposed through privileged support workflows even if signing keys remain intact.
- EVIDENCE FOUND
- The May 2025 filing attributes stolen data to paid overseas support personnel and says passwords and private keys were not compromised.
- DO NOT INFER
- A company filing is authoritative for its disclosure, not an independent forensic audit of every affected record.
Sources: Coinbase Form 8-K — 14 May 2025 ↗
Financial consequence
- CLAIM UNDER REVIEW
- Privacy incidents can create direct reimbursement and legal cost beyond account-security controls.
- EVIDENCE FOUND
- Later SEC reporting records material costs connected with the event.
- DO NOT INFER
- Reported cost does not quantify each person's harm or current control effectiveness.
Sources: Coinbase 2025 Form 10-K ↗
Transaction observability
- CLAIM UNDER REVIEW
- Simple trading connects verified identity, quote and transaction records inside one provider environment.
- EVIDENCE FOUND
- The fee page documents provider-priced Simple transactions and account-specific charges.
- DO NOT INFER
- A pricing page does not disclose all telemetry recipients or prove cross-service data minimisation.
Sources: Coinbase fees disclosure ↗ · Coinbase User Agreement — United States ↗
EXPERT PRIVACY REVIEW / 8 FLOWS
From identity edge to revision trigger.
Coinbase's US individual hosted account, identity checks, transaction data, custody record and support chain. Coinbase Wallet and every non-US entity are separate privacy subjects.
Users comfortable with verified custodial accounts who value public-company disclosures and can keep Coinbase Wallet separate from Coinbase.com.
People seeking pseudonymous onboarding, local-only transaction metadata, minimal identity retention, or a privacy conclusion that automatically covers Coinbase Wallet.
Contracting and custody language is accessible
Kraken provides a different entity and control disclosure set; moving to a self-custody wallet reduces hosted key control but makes public-chain and RPC privacy a new problem.
IDENTITY / AUTHORITY BOUNDARY
The reviewed agreement names Coinbase, Inc. and authorises broad identity, bank, device, fraud and compliance inquiries. Hosted keys and account identity remain linked inside the custodial service.
- 01
A US retail user connects a bank, completes KYC, executes one hosted trade, contacts support about a harmless limit question, then withdraws to a fresh self-controlled address.
- 02
Bank-funded trade: KYC → bank link → quote/order → hosted ledger
- 03
Support-chain case: Authenticated account → support intake → overseas or vendor handling → resolution
- 04
Alternative path: Kraken provides a different entity and control disclosure set; moving to a self-custody wallet reduces hosted key control but makes public-chain and RPC privacy a new problem.
| FLOW QUESTION | BOUNDED FINDING | PROOF STATE | VERIFICATION PLANNED |
|---|---|---|---|
| Who establishes identity? | Coinbase can collect identity, tax, bank and in some cases biometric information and can query fraud or credit-reference providers. | SUPPORTED RECORD | Record the actual minimum fields and third-party notices shown to the test account. |
| Can identity be separated from keys? | Hosted assets use Coinbase-controlled private keys and account ledgers; the hosted identity and transaction history therefore remain operationally linkable. Coinbase User Agreement — United States ↗What Coinbase does with digital assets ↗ | SUPPORTED RECORD | Trace what account and withdrawal identifiers are exposed in the user export and support view. |
| What does the incident prove? | The 2025 filing documents data obtained through paid overseas support personnel and says passwords and private keys were not compromised. It is a scoped historical record, not a present privacy guarantee. | SUPPORTED RECORD | Check current support authentication and least-access explanations without attempting privilege tests. |
| Which legal perimeter applies? | The US agreement and SEC filings provide entity traceability. They do not determine rights or retention in another market. Coinbase User Agreement — United States ↗Coinbase 2025 Form 10-K ↗ | SUPPORTED RECORD | Bind the privacy notice and dispute route to the exact contracting entity. |
| What joins bank and trade data? | Funding and hosted transactions can connect verified identity, bank information, quoted trade and account history in one regulated service. Coinbase User Agreement — United States ↗Coinbase fees disclosure ↗ | SUPPORTED RECORD | Observe the minimum bank-link fields and whether a manual rail avoids an additional data recipient. |
| What can account and API permissions expose? | The reviewed terms cover website, app and API access, but the file does not yet contain an observed API-scope or session inventory. | VERIFICATION PLANNED | Create read-only credentials if available and record scopes, revocation and audit events. |
| How do complaints and support handle data? | Contractual complaint and arbitration routes exist; the incident makes support access, authentication and export scope a first-order privacy test. Coinbase User Agreement — United States ↗Coinbase Form 8-K — 14 May 2025 ↗ | PARTIAL RECORD | Open a non-sensitive case and document every identity challenge, handoff and visible case field. |
| How is a claim corrected? | Terms and services can change and public filings can add incident facts. Every privacy conclusion therefore needs a dated source and visible revision node. Coinbase User Agreement — United States ↗Coinbase 2025 Form 10-K ↗ | SUPPORTED RECORD | Diff the agreement, privacy link and filings before publication. |
| SCENARIO | SEQUENCE | DATA DISCLOSED | OPEN QUESTION |
|---|---|---|---|
| Bank-funded trade | KYC → bank link → quote/order → hosted ledger | Identity, financial-account data, device signals and transaction history described by the agreement. | Which vendors receive each field and how long is it retained after account closure? |
| Support-chain case | Authenticated account → support intake → overseas or vendor handling → resolution | Case content and account-verification data; the filing shows a historically material vendor-access risk. Coinbase Form 8-K — 14 May 2025 ↗Coinbase User Agreement — United States ↗ | Which fields are masked, logged and available to each support tier today? |
Build a data inventory before onboarding: field, purpose, controller, recipient, retention statement and user control. Observe network destinations only with test data; keep support, bank, trade and withdrawal identifiers segregated.
Medium-high for the contractual identity and custody data map and the 2025 support-chain incident; insufficient for current vendor list, actual telemetry, deletion execution and support-case access controls.
- Coinbase changes the US privacy, identity or support-vendor terms.
- A live test identifies undisclosed recipients or controls that materially narrow or expand the flow.
- A new filing changes the known incident or remediation record.
CHANGE / REVISION TRAIL
Rechecked US terms and the SEC incident record; added identity, support-access and bank-to-withdrawal scenarios.
Opened the claim-to-evidence privacy dossier.
Coinbase changes the US privacy, identity or support-vendor terms.
DECISION FAQ
Is Coinbase Wallet covered by this privacy file?
No. The hosted account and unhosted wallet have different custody and data flows.
Did the 2025 incident expose private keys?
The cited filing says passwords and private keys were not compromised; it does not erase the personal-data impact.
Has deletion been tested?
No. Data export, correction, deletion and retention behaviour remain observation tasks.
What would change this privacy conclusion?
Coinbase changes the US privacy, identity or support-vendor terms. A live test identifies undisclosed recipients or controls that materially narrow or expand the flow. A new filing changes the known incident or remediation record.
PRIMARY SOURCE REGISTER
5 records
Source access and applicable scope were recorded on 16 August 2026; records are attributed by class.- termsCoinbase User Agreement — United States ↗Retrieved 2026-08-16
- productWhat Coinbase does with digital assets ↗Retrieved 2026-08-16
- productCoinbase fees disclosure ↗Retrieved 2026-08-16
- filingCoinbase Form 8-K — 14 May 2025 ↗Retrieved 2026-08-16
- filingCoinbase 2025 Form 10-K ↗Retrieved 2026-08-16