Coinbase

Coinbase is the most heavily licensed venue in this corpus and one of the very few that files audited accounts with a securities regulator. It still scores a B rather than higher, because being a public company is not the same as showing readers what you hold.

What checks out

Regulation is the clean factor. Coinbase holds a New York BitLicense, a FinCEN MSB registration, UK FCA registration FRN 900635 and licences in 45 U.S. states — every one of those checkable on a public register. The SEC's 2023 unregistered-exchange suit was dismissed with prejudice on 27 February 2025. A $100m NYDFS consent order from January 2023 sits on the same record and belongs beside it. We found no confirmed platform-level breach of customer funds.

Where the evidence stops

There is no exchange-wide proof-of-reserves programme. Reserve assurance rests on Deloitte-audited filings made as an SEC-reporting public company, plus per-asset attestations for wrapped tokens such as cbBTC. That is stronger than nothing, and weaker than a Merkle-tree proof you can check your own balance against. Coinbase Custody is an NYDFS-regulated qualified custodian, but the cold/hot split is not published and we could not confirm it from a primary source. The last crime-insurance figure we can point to — $255m covering hot-wallet assets — was disclosed in 2019; the company still advertises commercial crime cover for custodied assets without confirming a current number.

How to read the grade

Coinbase's protections are mostly institutional: audited accounts, a regulated custodian, a supervised licence book. They are meaningful, and they are not the same thing as a cryptographic proof you can verify yourself. The B says the paperwork is in order, and that the reader-verifiable evidence is thinner than the paperwork suggests.