Home › Crypto › Exchange & wallet security history
Direct answer: Spot crypto at Kraken, Coinbase, and Crypto.com has zero FDIC or SIPC insurance (FDIC FIL-35-2022). Coinbase (2021 SMS 2FA; 2025 contractor bribery) and Crypto.com (2022 $33.8M 2FA bypass) reimbursed affected users; Kraken had a 2024 $3M CertiK bug-bounty incident with no customer loss. Coldcard, Ledger, and Trezor are non-custodial.
By the numbers: In the 12 months through Oct. 12, 2026, the CFPB published 1,043 complaints naming Coinbase, 274 naming Kraken, 218 naming Crypto.com, and 12,015 naming Chime. Source: CFPB Consumer Complaint Database (pulled 2026-10-12)
“The FDIC only insures deposits held in insured banks and savings associations and only in the unlikely event of an insured bank's failure. The FDIC does not insure assets issued by non-bank entities, such as crypto companies.” — FDIC Consumer News & Financial Institution Letter FIL-35-2022
Updated 2026-10-24
No. Per FDIC FIL-35-2022 and SIPC's What SIPC Protects page, spot cryptocurrency balances have zero FDIC or SIPC coverage. Only USD cash held at an FDIC-insured bank is eligible for FDIC deposit insurance against bank failure.
Coinbase (2021 SMS 2FA takeover of ~6,000 accounts; May 2025 support-contractor bribery disclosure), Crypto.com (Jan 2022 $33.8M 2FA bypass across 483 accounts), Kraken (June 2024 $3M CertiK deposit bug, no customer loss), Ledger (2020 e-commerce PII leak; Dec 2023 Connect Kit NPM exploit), and Trezor (2020 physical STM32 glitching without passphrase; Jan 2024 support contact leak). Coldcard has had zero remote or customer-data breaches.
Chime is a financial technology company, not a bank, and does not custody spot crypto. USD deposits in Chime checking and savings accounts are held at The Bancorp Bank, N.A. or Stride Bank, N.A., Members FDIC, with pass-through FDIC insurance up to $250,000 per depositor when pass-through requirements are met.
Spot cryptocurrency held on Kraken, Coinbase, and Crypto.com has zero FDIC or SIPC coverage (FDIC FIL-35-2022; SIPC: What SIPC Protects). Custodial exchanges hold your private keys and have experienced account-takeover, contractor-bribery, or bug-bounty incidents (with customer reimbursements on the 2021/2025 Coinbase and 2022 Crypto.com breaches and zero customer loss on Kraken's 2024 CertiK bug). Non-custodial hardware wallets (Coldcard, Ledger, Trezor) keep private keys offline on your device, shifting risk from exchange hacks to physical seed storage, supply-chain software, and customer-data leaks. Chime is a fintech platform (not a bank) whose USD deposits carry pass-through FDIC insurance up to $250,000 via The Bancorp Bank, N.A. or Stride Bank, N.A., Members FDIC.
Primary sources verified 2026-10-24: FDIC FIL-35-2022 · SIPC: What SIPC Protects · CFPB Consumer Complaint Database. Facts-only security and insurance history compiled from SEC filings, FDIC/SIPC advisories, CFPB complaint records, and official company post-mortems. Not financial, legal, or security advice, and not an endorsement or 'safe to use' verdict.
Side-by-side comparison of custody model, statutory insurance reality under FDIC FIL-35-2022 and SIPC rules, documented breach history, and CFPB complaint volume (Data as of 2026-10-24):
| Company / Device | Custody Model | Spot Crypto Insurance | USD Cash / Deposit Insurance | Documented Security Incidents | CFPB Complaint Record (as of 2026-10-12) |
|---|---|---|---|---|---|
| Kraken (Payward, Inc.) | Custodial crypto exchange (holds private keys for exchange balances) | Zero FDIC or SIPC coverage on spot crypto balances (FDIC FIL-35-2022; SIPC investor bulletin). | Uninvested USD cash depends on account type and holding institution; Kraken is not an FDIC-insured bank. | No hot/cold wallet customer-fund loss; June 2024 CertiK $3M deposit-crediting bug bounty incident (funds returned, $0 customer loss). | 274 complaints in last 12 mo; 524 over 36 mo (97.1% timely response, as of 2026-10-12). |
| Coinbase (Coinbase Global, Inc.) | Custodial crypto exchange (holds private keys for exchange accounts) | Zero FDIC or SIPC coverage on spot crypto balances (crime insurance policy covers physical/cyber theft of Coinbase-held keys, not individual credential phishing). | USD cash balances held in omnibus custodial accounts at FDIC-insured partner banks or money market funds per User Agreement. | Mar–May 2021 SMS 2FA account-takeover campaign (~6,000 accounts, reimbursed); May 2025 bribed support-contractor social-engineering breach (SEC Form 8-K, no hot/cold wallet key compromise; reimbursement pledge). | 1,043 complaints in last 12 mo; 3,356 over 36 mo (99.1% timely response, as of 2026-10-12). |
| Crypto.com (Foris DAX, Inc.) | Custodial crypto exchange (holds private keys for app/exchange accounts) | Zero FDIC or SIPC coverage on spot crypto balances. | USD fiat wallet balances held at FDIC-insured partner banks subject to program terms. | Jan 17, 2022 2FA bypass breach (483 accounts, ~4,836 ETH + 443 BTC / ~$33.8M; 100% of affected customer balances reimbursed). | 218 complaints in last 12 mo; 731 over 36 mo (98.4% timely response, as of 2026-10-12). |
| Coldcard (Coinkite Inc.) | Non-custodial, air-gapped Bitcoin-only hardware wallet (you hold the seed & private keys) | Not applicable (self-custody; no third-party custodian holds your coins). | Not applicable (hardware device, no fiat accounts). | Zero remote or custodial breaches. Mk1–Mk3 change-address/PSBT isolation advisories patched in firmware; physical lab glitching mitigated by dual secure elements (Mk4/Q) + PIN/passphrase. | Not in CFPB database (hardware manufacturer, not a financial custodian). |
| Ledger (Ledger SAS) | Non-custodial multi-chain hardware wallet (dual-chip Secure Element + Ledger Live software) | Not applicable (self-custody). | Not applicable. | Zero remote key extraction from Secure Element; July 2020 e-commerce PII leak (~272,000 customer addresses/phones) & Dec 14, 2023 Ledger Connect Kit NPM supply-chain exploit (~$600k drained from EVM dApps, reimbursed). | Not in CFPB database (hardware manufacturer). |
| Trezor (SatoshiLabs s.r.o.) | Non-custodial open-source hardware wallet (Trezor Model One, Model T, Safe 3, Safe 5) | Not applicable (self-custody). | Not applicable. | Zero remote breaches; physical voltage-glitch seed extraction demonstrated on older STM32 chips when no BIP-39 passphrase is enabled (Kraken Security Labs, Jan 2020; mitigated by passphrase or Safe 3/5 Optiga Trust M secure element) & Jan 2024 third-party support portal contact leak (~66,000 contacts). | Not in CFPB database (hardware manufacturer). |
| Chime (Chime Financial, Inc.) | Fintech checking & savings platform (not a bank; banking services via partner banks) | Does not custody spot cryptocurrency. | FDIC pass-through deposit insurance up to $250,000 per depositor, per insured bank, per ownership category via The Bancorp Bank, N.A. or Stride Bank, N.A., Members FDIC, when pass-through requirements are met. | No core partner-bank deposit vault breach; CFPB complaint profile centers on account freezes/closures and unauthorized EFT disputes under Regulation E. | 12,015 complaints in last 12 mo; 22,637 over 36 mo (99.8% timely response, as of 2026-10-12). |
Every security event below is sourced to an SEC filing, official post-mortem, security lab disclosure, or the CFPB Consumer Complaint Database. VaultRubric does not issue 'safe to use' verdicts; read the primary facts and custody trade-offs for each provider.
VaultRubric deep dives: Kraken CFPB complaints · Was Kraken hacked? · Is Kraken safe? (Custody & reserves facts)
VaultRubric deep dives: Coinbase CFPB complaints · Is Coinbase safe? · Was Coinbase hacked?
VaultRubric deep dives: Crypto.com CFPB complaints · Is Crypto.com safe? · Was Crypto.com hacked?
VaultRubric deep dives: Was Coldcard hacked? · Coldcard seed & PSBT advisories explained · How to buy a hardware wallet safely
@ledgerhq/connect-kit JavaScript library to NPM. For roughly 5 hours, users connecting to third-party EVM dApps (such as SushiSwap or Revoke.cash) were served a drainer popup, resulting in ~$600,000 in stolen EVM assets. Ledger deactivated the malicious package with WalletConnect and committed to making affected victims whole. Source: Ledger Dec. 14, 2023 Security Incident Report.VaultRubric deep dives: Ledger vs. Trezor comparison · Was Ledger hacked? · Was Trezor hacked? · Ledger Connect Kit hack explained · How to buy a hardware wallet safely
VaultRubric deep dives: Chime CFPB complaints · Is Chime safe? (Partner banks & Reg E facts) · Is Chime a good savings account?
No. Under FDIC Financial Institution Letter FIL-35-2022 (https://www.fdic.gov/news/financial-institution-letters/2022/fil22035.html) and the SIPC page What SIPC Protects (https://www.sipc.org/for-investors/what-sipc-protects), spot cryptocurrency balances (such as BTC, ETH, or SOL) held at Kraken, Coinbase, or Crypto.com have zero FDIC deposit insurance and zero SIPC brokerage protection. FDIC insurance covers only USD cash deposits held at an FDIC-insured bank, and only against the failure of that insured bank.
Kraken has not reported a hot- or cold-wallet breach resulting in permanent customer fund losses. In June 2024, Kraken disclosed that security firm CertiK exploited a deposit-crediting bug to mint and withdraw nearly $3 million in unbacked crypto from Kraken's treasury during a bug-bounty dispute; no customer balances were lost and the funds were returned (https://blog.kraken.com/news/security-advisory).
Between March and May 2021, attackers exploited a flaw in Coinbase's SMS account-recovery flow to bypass SMS two-factor authentication on roughly 6,000 customer accounts; Coinbase reimbursed affected customers (https://www.sec.gov/ix?doc=/Archives/edgar/data/1679788/000167978822000031/coin-20211231.htm). In May 2025, Coinbase filed an SEC Form 8-K disclosing that overseas support contractors had been bribed to copy customer contact/account data (<1% of monthly transacting users) for social-engineering attacks; no hot/cold wallets or private keys were compromised, and Coinbase pledged to reimburse retail customers tricked into sending funds to the attackers (https://www.coinbase.com/blog/protecting-our-customers-standing-up-to-extortionists).
On January 17, 2022, attackers bypassed two-factor authentication verification on Crypto.com and initiated unauthorized withdrawals from 483 customer accounts totaling roughly 4,836 ETH, 443 BTC, and $66,200 in other currencies (~$33.8 million at the time). Crypto.com paused withdrawals, revoked all 2FA tokens, reimbursed 100% of affected customer balances, and replaced its 2FA infrastructure (https://web.archive.org/web/20230129231034/https://crypto.com/product-news/crypto-com-security-report-next-steps).
Coldcard (Coinkite) has had zero remote or custodial breaches because it is a non-custodial, air-gapped Bitcoin hardware wallet (https://coldcard.com/docs/upgrade/). Earlier firmware versions (Mk1–Mk3) had PSBT change-address validation advisories that were patched in firmware. By comparison, Ledger suffered a July 2020 e-commerce customer PII breach (~272,000 physical addresses/phones) and the December 14, 2023 Ledger Connect Kit NPM supply-chain exploit (~$600k drained from EVM dApps, reimbursed), while older Trezor Model One/T devices without a BIP-39 passphrase were shown vulnerable to physical lab voltage-glitch seed extraction by Kraken Security Labs in 2020 (https://blog.kraken.com/product/security/kraken-identifies-critical-flaw-in-trezor-hardware-wallets) and Trezor's third-party support portal leaked ~66,000 contacts in January 2024 (https://blog.trezor.io/trezor-security-update-stay-vigilant-against-potential-phishing-attack-bb05015a21f8).
Chime is a financial technology company, not a bank. Banking services and FDIC deposit insurance up to $250,000 per depositor are provided through its partner banks, The Bancorp Bank, N.A. or Stride Bank, N.A., Members FDIC, on a pass-through basis when pass-through requirements are met (https://www.chime.com/policies/).
Facts-only security and insurance history compiled from SEC filings, FDIC/SIPC advisories, CFPB complaint records, and official company post-mortems. Not financial, legal, or security advice.