CoinTracker can organize portfolio and tax information, but it is not an exchange, a wallet or a custodian. That view-only design creates an important security boundary: the application can read transaction history from connected sources, while your cryptocurrency remains in the external wallet or exchange that actually controls it. This guide explains how to keep that boundary intact, protect tax data and recognize scams that misuse the CoinTracker name or a misleading on-screen balance.
Last reviewed: October 5, 2026. CoinTracker features, supported connections, account settings and exchange API interfaces can change. Confirm current instructions in CoinTracker and at the relevant exchange before changing permissions. This independent guide is educational and does not provide tax, legal, investment or cybersecurity advice.
CoinTracker is a tracker, not a place where crypto is held
A portfolio tracker displays records imported from exchanges, wallets and blockchains. The software may calculate balances, gains, cost basis and tax reports, but it does not hold the private keys that control a self-custody wallet and does not keep assets in an exchange account. The actual ability to move funds remains with the wallet or exchange where the assets are held.
This distinction makes several scam claims easy to reject. A person claiming to represent CoinTracker should not ask you to send crypto to “unlock” a tracked balance, pay a fee before a withdrawal, connect a recovery phrase, or approve an on-chain transaction to release funds. A displayed transaction history is not proof that CoinTracker controls an asset, and CoinTracker cannot transfer funds to a bank account or wallet on your behalf.
What view-only access means
| Access or information | What it allows | Appropriate for CoinTracker? |
|---|---|---|
| Public wallet address | Reads activity already visible on the blockchain | Yes, when it is the correct account |
| Read/View API key | Reads balances, orders and transaction history allowed by the exchange | Yes, when needed for syncing |
| OAuth read-only authorization | Allows selected exchange data to be shared without copying a key | Yes, where officially supported |
| Trade or write API permission | Can place or modify orders | No |
| Transfer or withdrawal API permission | Can move funds or manage payout destinations | No |
| Seed phrase or private key | Controls self-custody crypto | Never |
| Password or current 2FA code | Authenticates a human account owner | Never share it |
Read-only is not the same as harmless. A read key should not be able to move assets, but it may reveal balances, trading history, wallet addresses, tax-relevant transactions and other sensitive financial information. Use the least privilege needed for the import and create a dedicated key for CoinTracker instead of reusing a key created for a bot or another portfolio application.
How to create a safer CoinTracker API connection
Each exchange uses different labels and permission screens, but the safe workflow is similar. Begin from the exchange you reached through a trusted bookmark or password-manager entry, rather than from an email or advertisement. In its API-management area, create a new key clearly named for the tax or portfolio connection.
- Use a dedicated key. Give it an unmistakable name such as “CoinTracker read-only 2026.”
- Enable only viewing permissions. Select Read, View, Query, History or comparable settings needed for the documented connection.
- Keep all asset-moving permissions disabled. Do not enable trading, transfers, withdrawals, address management, futures actions or account changes.
- Complete the exchange’s own activation step. This may require email confirmation or two-factor authentication.
- Enter credentials only in the legitimate CoinTracker connection flow. Do not paste them into support chat, a spreadsheet or an unknown browser extension.
- Verify the import. Compare dates, transaction counts and major balances with the original exchange account.
- Record the key’s purpose. Keep a private inventory of which application has each API key and when it should be reviewed.
Some exchanges need a key secret or a separate passphrase. Treat each component as a credential. If the service cannot connect with read-only permission, stop and check the official exchange-specific instructions; do not solve the problem by enabling withdrawal or trading access.
Protect API credentials and know when to revoke them
An API key can be copied more easily than a hardware device. Avoid screenshots, plain-text notes, chat messages and unencrypted downloads. If you need to retain an API secret while completing setup, use an encrypted password manager or another secure method that suits your security model. Once the key is working, consider whether you need to keep a separate copy at all.
Revoke and replace an API key if it was pasted into the wrong place, stored in a public repository, exposed in a screenshot, sent through an insecure channel, linked to a compromised device, or no longer required. Revoking the key at the exchange stops that key’s future access; deleting a CoinTracker wallet connection is a separate action and does not necessarily revoke the exchange credential.
| Situation | First action | Then verify |
|---|---|---|
| Key accidentally shared | Revoke it at the exchange immediately | API-key list, account activity and withdrawals |
| Sync stopped after an exchange change | Create a new dedicated read-only key if official guidance requires it | Date range and duplicate imports |
| Unknown key appears in exchange settings | Revoke it and secure the exchange login | Sessions, MFA, email and withdrawal controls |
| Old tax connection no longer needed | Revoke the old key after preserving required reports | Whether another active service relies on it |
Why CoinTracker never needs a recovery phrase
A public blockchain address lets a tracker read public transaction history. A seed phrase or private key does something entirely different: it gives control over the funds. The difference is non-negotiable. CoinTracker states that it does not need recovery phrases or private keys, and no genuine support workflow should request them.
Watch for deceptive wording such as “verify wallet ownership,” “repair a sync,” “validate your tax records,” “restore a balance” or “approve a security upgrade.” A legitimate tax import does not require you to reveal recovery words, sign an arbitrary transaction or connect a wallet to an unverified web page. Close the page and independently open the official service instead.
Fake transactions and fake balances: what the screen can mislead you about
Scammers sometimes add or point to transactions that appear to represent an investment, profit or deposit. The goal is to convince a victim that a large balance exists and can be released after a fee, tax, “gas payment” or verification step. A transaction visible in an application or explorer does not prove the recipient controls spendable funds, and an unfamiliar token may be worthless, malicious or unrelated to a real investment.
CoinTracker’s support guidance warns that scammers may add fake transactions to an account to create this impression. Do not make a payment because a support impostor says you must unlock a balance. Independently verify the asset on the real exchange or wallet that holds it, check the address and network, and do not interact with unsolicited tokens or unknown smart contracts.
- Do not pay a “withdrawal fee” to a person claiming CoinTracker holds your crypto.
- Do not rely on a screenshot, PDF or dashboard total supplied by a stranger as proof of funds.
- Do not click “claim,” “approve,” “migrate” or “validate” links attached to an unexpected token.
- Do not confuse a tax calculation with an exchange balance or a withdrawal request.
- When a claimed balance is important, verify through the exchange or self-custody wallet you independently control.
Recognize CoinTracker phishing and impersonation attempts
Phishing messages often create urgency: an account will be locked, a tax report will expire, suspicious activity requires immediate confirmation, or an unexpected refund is waiting. The message may use authentic-looking logos, a copied support signature and a domain that differs by only one character. The target is usually the password, multi-factor code, payment information or installation of remote-access software.
| Message or request | What to do instead |
|---|---|
| “Your CoinTracker balance will be forfeited today” | Open CoinTracker directly from a saved bookmark; do not use the email button |
| “Send crypto so we can verify your account” | Do not pay; CoinTracker does not custody or solicit funds |
| “Reply with your 2FA code” | Never disclose a current code or recovery code |
| “Install our support tool so we can fix your sync” | Do not give unsolicited contacts remote device access |
| “Your wallet needs a seed phrase to sync” | Stop immediately; use only the public address where applicable |
CoinTracker lists official email domains in its support guidance, but checking a sender alone is not enough because a message can be spoofed or a compromised mailbox can send it. The safer habit is to initiate the action yourself: type www.cointracker.io, use the known app entry, or open the official help centre through a bookmark.
Secure the CoinTracker account and the email behind it
Use a unique password for CoinTracker and store it in a password manager. Enable two-factor authentication in CoinTracker account settings and also protect the email account that receives resets and notifications. An attacker who controls that inbox may be able to reset other services, so review its recovery methods, forwarding rules, active sessions and connected applications.
Do not approve surprise authentication prompts. If an MFA request appears while you are not signing in, decline it and investigate. Update the CoinTracker password from a clean device if you suspect it was exposed, end unfamiliar sessions where controls permit, and change any other account that used the same password.
Protect tax reports, CSV files and accountant access
Tax data can be sensitive even though it cannot spend crypto. A report may reveal acquisition history, gains, losses, addresses, exchange use, account identifiers and transaction timing. Treat it as financial information. Download reports only to a device you control, use encryption and screen locking, and avoid uploading full exports to general-purpose file-sharing links unless the recipient and protection method are verified.
- Keep the original exchange CSV and a dated final report where records must be retained.
- Do not send a complete transaction history through public chat or to an unverified email address.
- Share the narrowest report that answers an accountant’s question.
- Verify a professional’s identity through contact details obtained independently.
- Remove temporary downloads from shared computers and unneeded cloud folders according to your retention plan.
- Never include seed phrases, private keys, passwords or two-factor codes in a tax file.
Response plan after suspected compromise
Move in dependency order. If a phishing page captured credentials, the email inbox may be more important than the tracker account because it can reset the tracker and other services. Use a known-clean device whenever possible.
- Secure the primary email: password, sessions, forwarding rules, recovery options and MFA.
- Change the CoinTracker password and enable or review two-factor authentication.
- At each connected exchange, revoke suspicious API keys and examine sessions, withdrawal addresses and account notifications.
- Generate new read-only credentials only after the exchange login is secure.
- Review CoinTracker wallet connections and remove ones you do not recognize.
- Scan or rebuild a potentially infected device before entering new credentials.
- Contact CoinTracker through its official support route, not by replying to a suspicious message.
- For a confirmed theft or fraud, preserve evidence and consider contacting the relevant exchange and local authorities promptly.
CoinTracker security checklist
- Use a unique CoinTracker password and protect the related email account.
- Enable two-factor authentication on CoinTracker, email and every exchange.
- Use one named, read-only API key for each connected application.
- Never enable trade, transfer or withdrawal permissions for a CoinTracker connection.
- Never disclose a seed phrase, private key, password, recovery code or current MFA code.
- Review API keys and revoke those that are obsolete or unfamiliar.
- Verify alleged balances in the external exchange or wallet, not through an unsolicited contact.
- Open CoinTracker and support pages directly instead of following urgent links.
- Protect reports and CSV exports as sensitive financial records.
Frequently asked questions
Can CoinTracker withdraw my cryptocurrency?
No. CoinTracker describes itself as a view-only tracking platform. A correctly configured connection uses read-only data access and cannot execute trades, transfers or withdrawals. Always verify actual API permissions at the exchange.
Why is a transaction showing in CoinTracker if I did not make an investment?
Public blockchain data, imports and unsolicited token transfers can create confusing entries. Do not assume a displayed transaction means a real or withdrawable investment exists. Check the source wallet or exchange independently and do not pay an alleged release fee.
Does CoinTracker need my wallet seed phrase?
No. A public address can provide relevant on-chain history. A seed phrase or private key controls funds and must never be shared with CoinTracker, support staff or anyone else.
What should I do if I shared my exchange API secret?
Revoke that API key at the exchange immediately, inspect the key permissions and account activity, secure the email and exchange login, then create a new dedicated read-only key only if you still need the connection.
Key takeaway
CoinTracker can organize crypto information without controlling crypto assets. Preserve that safety boundary by using only view permissions, protecting API credentials and account recovery, and refusing any request to send funds or reveal wallet secrets. A correct setup makes tax reporting more useful while keeping spending authority where it belongs: with you and the wallet or exchange you control.
Official CoinTracker resources
Use these official resources to confirm the current settings and get help with a specific security concern:
- Security best practices — account protection, two-factor authentication and safe handling of unsolicited requests.
- How wallet syncing works with API keys — read-only permissions, API-key storage and revocation.
- Identify and report scams — phishing, impersonation and fake-transaction warnings.