Coinbase is a real, Nasdaq-listed U.S. crypto exchange. The honest record has three tracks: the SEC's June 2023 charges were allegations never adjudicated; the February 2025 dismissal was explicitly “not on any assessment of the merits”; and the 2023 state actions were administrative determinations, several since unwound.

Scam verdict · Educational pattern check

Scam Detective research desk · Updated October 2026

Real exchange — merits never decided

Is Coinbase Legit? A Real, Public Exchange — With an SEC Case That Ended in a Shrug, Not a Verdict

Q: Did the SEC clear Coinbase?

No. The SEC dismissed its case in February 2025 with prejudice, stating on the record the dismissal was “not on any assessment of the merits of the claims alleged” — a discretionary call tied to its new Crypto Task Force. Neither a conviction nor an exoneration exists.

Q: Is the Coinbase withdrawal alert text real?

Treat any “Coinbase” text, call, or email about a withdrawal, verification code, or account lock as a costume — real alerts live in the app you open yourself. No real exchange ever asks for a code or a callback. Verify inside the app; report the message at ic3.gov.

Coinbase is a real, Nasdaq-listed U.S. crypto exchange — and the honest record has three tracks. In June 2023 the SEC charged it with operating as an unregistered exchange, broker, and clearing agency and with an unregistered staking offer — allegations, never adjudicated. In February 2025 the SEC dismissed the case with prejudice, stating on the record the dismissal was “not on any assessment of the merits.” Separately, ten state securities regulators moved against the staking program the same day in 2023, warning that nearly 3.5 million staking accounts carried no FDIC or SIPC protection; several states have since unwound their actions, per the company's own corporate blog. Neither a conviction nor an exoneration exists — and any “Coinbase” text about a withdrawal is a costume until you verify inside the app you opened yourself.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

Straight from the source

The verdict stands on the public record — the line below is quoted verbatim from the source named under it.

“The Commission's decision to exercise its discretion and dismiss this pending enforcement action rests on its judgment that the dismissal will facilitate the Commission's ongoing efforts to reform and renew its regulatory approach to the crypto industry, not on any assessment of the merits of the claims alleged in the action.”

— U.S. Securities and Exchange Commission, Feb. 27, 2025.

Why this question never goes away

Three tracks, no shortcut. Track one: the company is real — the largest U.S. crypto exchange, publicly traded. Track two: the SEC's June 2023 complaint — operating an unregistered exchange, broker, and clearing agency since at least 2019, plus an unregistered staking-as-a-service offer. The same day, a ten-state securities task force led by California hit the staking program, noting the accounts — nearly 3.5 million of them — carried no FDIC or SIPC protection against loss. Track three: February 2025, the SEC dismissed its action with prejudice, pointing to its new Crypto Task Force and stating explicitly that the merits were never assessed; several states have likewise dropped or unwound their staking actions, per the company's own corporate blog. So the record is real and the central legal question was never decided. The practical dangers are simpler: “Coinbase” withdrawal texts are pure costume, and no real exchange ever asks for a code or a callback.

Five red flags — any one is enough

Any “Coinbase” text, call, or email about a withdrawal, verification code, or account lock — the top crypto costume; real alerts live in the app you open yourself.

Reading the 2025 dismissal as vindication — the SEC said on the record the merits were never assessed; treat both the 2023 allegations and the “cleared” framing as incomplete.

Assuming bank-style protections — staking and crypto balances carry no FDIC or SIPC insurance; the state regulators' 2023 warning stands.

“Yield” offers from lookalike Coinbase sites or clone apps — the real URL and the official app-store listing are the only front doors; check before credentials.

Anyone who contacts you first about crypto — support impersonators and “advisors” both wear this brand; a real exchange never DMs.

Your next three moves

Use only the real app or coinbase.com you typed yourself; turn on two-factor authentication and withdrawal protections before funding.

Ignore and delete any “Coinbase” outreach; verify inside the app.

Crypto fraud goes to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov; securities questions to your state regulator — and run any “alert” link through the $2 instant check.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.