Is CoinLedger Safe? Security, Data Access and Company Facts

Last checked 23 Oct 2026 · Sources: coinledger.io/security, how to contact CoinLedger Support, wallet import guide, coinledger.io/about, CoinLedger’s Nov 2025 incident notice, refund policy and coinledger.io/pricing

What “safe” means for a crypto tax tool

A crypto tax tool doesn’t hold your crypto. The risks are what it can do with the access you give it, how it stores your financial data, and whether you can trust it with your money and your tax report. Here is what CoinLedger publishes on each.

Access to your accounts

• Read-only API keys. CoinLedger says API imports need read-only permissions and it never has access to your funds or private keys (security).
• Public addresses for wallets. On-chain wallets can be imported by public address, which gives view access only.
• File uploads. CoinLedger says uploaded transaction files are read into memory and discarded, and that “personal information is never saved” to its database.

What you control: when you create an exchange API key, switch on only read or view permissions. Revoke the key on the exchange once you’ve finished.

Does CoinLedger ask for your seed phrase?

No. CoinLedger says it never collects recovery phrases (seed phrases) or private keys, and that it will never ask for them, or for your password, by email, SMS or chat (Nov 2025 notice). Its support guidelines say staff will never ask you to share private or secret wallet keys (how to contact CoinLedger Support). If a site, app or message that calls itself CoinLedger asks for your seed phrase, it isn’t CoinLedger’s own import process.

CoinLedger’s import methods don’t need one. Exchanges connect with read-only API keys or transaction files (security), and self-custody wallets connect by pasting the wallet’s public receive address (wallet import guide).

How CoinLedger says it contacts you

• Email and chat only. CoinLedger says support contacts you only by email or chat (through Intercom). CoinLedger says support never phones you; the one exception is a follow-up call for customers of its Done For You service.
• Six sending domains. coinledger.io, mail.coinledger.io, email.coinledger.io, support.coinledger.io, alerts.coinledger.io and coinledger.intercom-mail.com. CoinLedger says mail from any other domain isn’t from its team.
• No messaging apps. CoinLedger says it never contacts users on Telegram, WhatsApp or similar apps.
• No mobile or desktop app. CoinLedger’s Nov 2025 notice says it doesn’t offer either, and tells users not to download any app or software that claims to be CoinLedger.

Sources checked 27 Oct 2026: CoinLedger support contact guidelines, wallet import guide, CoinLedger’s Nov 2025 notice and coinledger.io/security.

If you were asked for your seed phrase

• Don’t type it in. Close the page or app, then open CoinLedger yourself from a bookmark or by typing coinledger.io.
• If you already entered it, treat that wallet as exposed. A seed phrase can’t be changed, so the usual step is to create a new wallet with a new phrase and move your funds to it.
• Check your exchange API keys. Delete any key you didn’t create, and make sure the keys you use for CoinLedger have trading and withdrawal permissions switched off.
• Report it to CoinLedger through the chat inside coinledger.io, opened yourself, rather than replying to the message.

How data is protected, as CoinLedger describes it

• Passwords hashed with PBKDF2 using HMAC-SHA256, a 128-bit salt and 10,000 iterations.
• All traffic encrypted in transit; API and app endpoints are TLS/SSL only.
• Servers inside a virtual private cloud with network access control lists.
• Infrastructure across multiple availability zones for failover.
• Card payments processed by Stripe, not stored by CoinLedger.
• In-account deletion of all transaction data and exchange connections.

The security page doesn’t mention an independent certification such as SOC 2, a bug-bounty programme or past security incidents; a November 2025 incident at an analytics vendor is covered below. Treat these as the company’s own statements.

Company facts

• Founded in 2018 as CryptoTrader.Tax by David Kemmerer (CEO), Lucas Wyland (CTO) and Mitchell Cookson (about).
• Business address listed in the site footer: 231 S Bemiston Ave, Ste 850, Saint Louis, MO 63105, United States.
• Free for tax professionals to use; individuals pay per tax-year report.

Third-party incident: November 2025

On 21 Nov 2025, CoinLedger published a notice of a security incident at its analytics vendor, Mixpanel. According to the notice, an attacker gained access to Mixpanel’s systems through an SMS phishing attack, which Mixpanel’s security team became aware of on 9 Nov 2025. The attacker then exported two datasets containing CoinLedger user information. Mixpanel told CoinLedger on 17 Nov 2025. Mixpanel’s own disclosure says it detected the smishing campaign on 8 Nov 2025.

Per CoinLedger’s notice, the data involved was analytics profile information:

• First and last name, if set on the CoinLedger profile
• Email address
• Approximate location derived from the browser (city, state, country)

The notice says the incident did not involve passwords, recovery phrases or private keys, Social Security numbers or other government IDs, tax forms, transaction data, or bank or card numbers. CoinLedger says it found no evidence that the incident extended beyond Mixpanel’s systems. It names phishing or spam as the most likely risk to users.

Money: what you risk when paying

• Reports cost $49 to $499 per tax year, as a one-time purchase (pricing); see CoinLedger pricing.
• Refunds come with conditions: within 14 days, before any download, and only for a verified bug or product limitation (refund policy).
• The free tier shows your gains before you pay, so you can check imports for missing cost basis first.

Related reading: CoinLedger review and CoinLedger Form 8949.

What this page doesn’t cover

This page reports CoinLedger’s own published statements; it isn’t a security audit or a hands-on review, and it doesn’t rate the accuracy of reports. It is general information, not tax advice.

See CoinLedger plans (opens in new tab)