Coinbase spent five years telling regulators its customer money was safeguarded by automated controls. Ireland’s central bank just published what actually happened: the cash sat in the wrong accounts, the internal dashboard was broken, and nobody told the regulator for half a decade. Then Washington sent them another billion dollars of seized bitcoin.
That is not a custody model. That is a trust fall with a legal department.
Quick Summary
Ireland’s central bank fined Coinbase Ireland €3.25 million ($3.65 million) for failing to keep customer money where the law says it must sit. The breaches ran from November 2020 to August 2025: the exchange leaned on its US parent to run the safeguarding controls, left its safeguarding account underfunded “for lengthy periods of time,” and never told the regulator when its practices changed. Coinbase says it self-reported and fixed it, and that nobody lost a cent. This landed the same week the US government parked more than a billion dollars of seized bitcoin with Coinbase-linked addresses. Read that sentence again.
What Happened
The Central Bank of Ireland announced the penalty on Thursday, one day after reaching a settlement with Coinbase Ireland Limited. The company admitted the contraventions and agreed to the undisputed facts. The base penalty was €4.65 million, discounted 30% for settling. It was the regulator’s 164th enforcement outcome and pushed its lifetime fines past €432 million.
Here is what Coinbase Ireland actually is, because this part gets skipped: it issues the euro and dollar balances European customers use to buy bitcoin. Those balances are supposed to sit in dedicated safeguarding accounts, walled off from corporate money and from customers of other Coinbase entities. Under Ireland’s Electronic Money Regulations, that is not a nice-to-have. It is the whole licence.
The Central Bank found three failures. Coinbase Ireland placed “excessive reliance” on its US-based group to design and run its safeguarding controls, and lacked the local expertise to oversee that work. Its safeguarding account was underfunded “for lengthy periods of time” because of poor system design and weak control testing. And it had no adequate process to flag material changes in its safeguarding practices to the regulator.
Karen O’Leary, the Central Bank’s director of enforcement, did not mince words: “Failing to adhere to the assurances made during the authorisation process or to inform us of material changes as happened in this case is completely unacceptable. Payment and e-money firms have a fundamental obligation to fully safeguard customers’ funds.”
Translation: you promised automated safeguards in 2019 to get the licence, then quietly drifted away from them and didn’t tell anyone.
Coinbase’s own account, published in a blog post, is somehow worse in the details. During the March 2023 US banking crisis, as Silvergate Bank neared collapse, Coinbase Ireland directed 30 customers to deposit dollars into a Coinbase, Inc. account at another US bank, mixing their money with a separate Coinbase entity. After Brexit forced the migration of European customers off the UK affiliate, some kept sending deposits to the old UK accounts. Euro withdrawals for US and UK customers of other Coinbase units were at times paid out of the Irish safeguarding account for liquidity reasons.
And then the coding errors: Coinbase says a broken internal dashboard left the safeguarding account underfunded by an average of roughly 0.54% of its total obligation through 2023 and the first half of 2024. A daily “Treasury Rebalancing Process” shovelled funds back into the right account each day. That fixes the paperwork. It does not fix the fact that, on any given day, customer money was not where the licence required it to be.
A Coinbase spokesperson told Reuters that “these issues largely arose in the context of Coinbase taking steps to protect customers during periods of significant disruption.” The company also says it redesigned its safeguarding calculation, passed two third-party validations with no open findings, posted a €25 million guaranty bond, and hired a dedicated head of safeguarding.
Fine. Credit where due. But this is not a first offence. In November 2025 the Central Bank fined Coinbase Europe €21.5 million for failing to monitor more than 30 million transactions for money laundering and terrorist financing risk. The Irish registration lapsed at the end of 2025 as Coinbase moved its European headquarters to Luxembourg under a MiCA licence. Two enforcement actions, two different entities, one pattern.
Why This Matters for Bitcoin
Coinbase is not a small shop. It is the largest US crypto exchange, the world’s biggest custodian of bitcoin, and it holds coins on behalf of most US spot bitcoin ETFs. When a company that size cannot keep customer cash in the correct account for five years, the failure is not administrative trivia. It is a statement about what “custody” actually means when the custodian is a company with shareholders, a growth target, and a legal department.
Now put the two stories of this week side by side. On one side, a regulator in Dublin documenting years of sloppy safeguarding, commingled deposits, and an underfunded customer account. On the other, the US government moving a billion-plus dollars of seized bitcoin into Coinbase-linked addresses, treating the exchange as the default vault for coins it took off criminals.
That is the whole custodial model in one week: the same institution is simultaneously the place regulators fine for losing track of customer money and the place governments use to store the money they seize. The coins are real. The promise of “segregated, safeguarded, audited” is only as good as the dashboard the interns coded.
This is not a Coinbase problem. It is a structure problem. FTX was a fraud. Mt. Gox was incompetence. Coinbase is a publicly traded, regulated, audited company, and it still could not keep the accounts straight. If the best-resourced custodian on earth needs a daily manual rebalancing process to put customer money back where it belongs, ask yourself what your exchange looks like on a Tuesday when the systems are stressed and nobody is watching.
We have written about this before: the Coinbase AWS outage that left users staring at zeros, the allegations that Coinbase hid $1 billion in hacks, and the insider theft from US government bitcoin custody. The lesson repeats because the model repeats. Every one of these stories ends in the same place, and it is never the customer’s keys.
The Love Is Bitcoin Takeaway
Pick a side. Ours has not moved in ten years.
If you hold bitcoin on an exchange, you hold a promise. The promise is issued by a company that answers to shareholders, not to you, and it is enforced by a regulator who finds out about the problems years later. Ireland’s central bank did its job here, and it still took five years and a self-report to get there. That is the fastest this system ever moves.
Self-custody is not a personality. It is the only version of this where the failure mode is your own mistake and not someone else’s dashboard. Learn the wallet, write down the words, test the backup, and stop treating a login screen as ownership.
If you have been putting this off, start with a hardware wallet and a plan you can actually execute: choosing a Bitcoin wallet without getting rekt is the boring-but-real framework. Then read why spot bitcoin ETFs and exchange balances are not the same thing as owning bitcoin.
When you are ready to move, buy through Bull Bitcoin with the coupon code LOVEISBITCOIN and send it straight to a wallet you control. Not your keys, not your coins. It was true in 2014 and it is still the only sentence in this industry that has never been wrong.
What Beginners Should Do Next
- Check what your exchange actually holds for you. If the answer is “a balance on a screen,” you own an IOU.
- Move long-term savings to a hardware wallet. Leave only trading money on the exchange.
- Test your backup once, in daylight, before you need it in a panic.
- Understand that regulation is not protection. Coinbase was regulated the entire time its safeguarding account was underfunded.
- If you must use a custodian, use one that publishes proof of reserves and lets you withdraw without a support ticket.
FAQ
What was Coinbase fined for in Ireland? €3.25 million ($3.65 million) for breaching Ireland’s Electronic Money Regulations between November 2020 and August 2025: excessive reliance on its US parent for safeguarding controls, a safeguarding account that was underfunded for lengthy periods, and failure to notify the Central Bank of material changes to its practices.
Did anyone lose money? Coinbase says no customer lost money or access to funds. The regulator’s finding is about where the money sat and who controlled it, not about a shortfall at withdrawal time.
Is Coinbase still the biggest bitcoin custodian? Yes. It is the largest US crypto exchange, the world’s biggest custodian of bitcoin, and it holds coins on behalf of most US spot bitcoin ETFs.
Does this mean Coinbase is insolvent? No. This is a safeguarding and governance failure, not a solvency event. It is still a reason to understand the difference between holding bitcoin and holding a claim on bitcoin.
What is the alternative? Self-custody: a hardware wallet, a seed backup you control, and buying through a service like Bull Bitcoin with code LOVEISBITCOIN, then withdrawing to your own wallet.
Final Thoughts
The fine is €3.25 million. Coinbase will pay it out of petty cash and issue a blog post about how it self-reported. The regulator will move on to case 165. Nobody goes to jail, no customer gets compensated for five years of not knowing where their euros were, and the marketing keeps saying “trusted custodian” like the last week never happened.
The uncomfortable part is not that Coinbase screwed up. Companies screw up. The uncomfortable part is that the government, the ETFs, and most of your colleagues have decided this is fine, and that a billion dollars of seized bitcoin belongs in the same building where the customer accounts were underfunded for five years.
So here is the question, and I want the real answer in the comments: if the biggest, most regulated, most audited bitcoin custodian on earth could not keep your money in the right account for five years, what exactly are you trusting when you leave your bitcoin on an exchange, and what would it take for you to move it?
COINBASE COULDN'T KEEP CUSTOMER MONEY IN THE RIGHT ACCOUNT FOR FIVE YEARS — IRELAND FINED IT $3.6 MILLION, AND WASHINGTON STILL CALLS IT CUSTODY
