Is Koinly Safe? Data Access, Storage, And Third-Party Risk

What Koinly Sees When You Connect a Wallet or Exchange

Koinly uses read-only API access when you connect an exchange account. This means the software can retrieve transaction history, deposit records, withdrawal records, and trade data, but it cannot place orders, transfer funds, or modify your account in any way. The API key you generate on the exchange controls these permissions.

When you connect a blockchain wallet, Koinly only requires the public wallet address. No private keys, no seed phrases, no signing permissions. The platform queries public blockchain explorers to pull transaction history associated with that address. This is structurally safer than exchange API connections because there is no authentication token involved at all.

The risk here is not what Koinly is designed to access. The risk is what you accidentally grant when you create the API key. Exchange API systems allow you to specify exactly what the key can do: read transaction history, place trades, initiate withdrawals. If you check the wrong box when setting up the key, you have created a withdrawal-enabled token that now exists in Koinly's database. Not because Koinly asked for it, but because you gave it.

The platform does not need or request withdrawal permissions. But if your API key has those permissions attached and your Koinly account is compromised, that key becomes a direct attack vector. This is user-controlled risk, not a flaw in Koinly's design, but it is real exposure nonetheless.

Where That Data Is Stored and How It Is Protected

Koinly hosts the vast majority of its services and data in Amazon Web Services facilities in the United States. API keys and blockchain wallet addresses are encrypted before storage on Koinly's servers. The platform holds SOC 2 and ISO 27001 certifications and is GDPR compliant.

All API and application endpoints use TLS/SSL encryption and score an A+ rating on SSL Labs' tests, with strong cipher suites, HSTS, and Perfect Forward Secrecy fully enabled. These are not marketing claims. They are measurable security configurations that reduce the risk of man-in-the-middle attacks during data transmission.

Koinly does not hold custody of any crypto assets. It does not store private keys or seed phrases because it never asks for them. The platform is a reporting tool, not a wallet or exchange. This structural design removes the most dangerous attack surface: the ability to move user funds directly.

But the platform does store API keys, transaction metadata, portfolio balances, and personally identifiable information like names and email addresses. That data is encrypted at rest, but encryption is only as strong as the access control protecting the decryption keys. If an attacker gains administrative access to Koinly's infrastructure, encrypted data becomes readable data.

The Mixpanel Breach and What It Exposed

In December 2025, Koinly disclosed that email addresses and limited user metadata may have been exposed through a third-party breach at Mixpanel, an analytics service provider the company used to track user behavior and feature usage. Mixpanel itself was compromised, and data shared with Mixpanel by Koinly became accessible to unauthorized parties.

Koinly confirmed that no wallet information, transaction history, tax reports, or portfolio data was shared with Mixpanel or compromised in the incident. The information disclosed could have contained names, email addresses, rough position details like city or country, and device data like operating system and browser version.

This is the documented security incident in Koinly's history. The breach did not originate within Koinly's primary systems. It originated at a third-party analytics vendor, and the exposure was limited to metadata that Koinly had shared with that vendor for product improvement and user tracking. The company stopped using Mixpanel after the incident and initiated an audit of other third-party tools that process user information.

What the incident demonstrates is third-party risk. Koinly's main infrastructure was not compromised, but the data that left Koinly's controlled environment and entered a vendor's system became vulnerable to that vendor's security practices. This is a structural risk in any platform that integrates external services, and it is one that users cannot fully avoid without opting out of the platform entirely.

The company has not disclosed the exact number of users impacted or the specific timeframe during which the exposure occurred. It stated that it is collaborating with Mixpanel to determine the full extent of the incident, but as of publication, no further details have been made public.

API Permission Scopes and What You Control

When you create an API key on an exchange, you are presented with a set of permission checkboxes. Typical options include Read, Trade, and Withdraw. Koinly only needs Read permissions to function. It needs to see your transaction history to calculate cost basis and generate tax reports. It does not need to place trades or move funds.

If you enable Trade or Withdraw permissions when creating the key, you have given that key the ability to execute those actions. The key itself becomes a bearer token: anyone who possesses it can perform the actions it authorizes. If that key is stored in Koinly's database and your Koinly account is compromised, the attacker now holds a token with withdrawal permissions.

This is not a hypothetical risk. Forum evidence shows users reporting unauthorized account activity following API key creation, though no direct Koinly culpability was established by investigators. The more likely explanation is that users either enabled excessive permissions or that their exchange accounts were compromised through unrelated vectors like phishing or credential reuse.

The safe configuration is simple: when creating an API key for tax reporting software like Koinly, enable only Read or View permissions. Never check Trade. Never check Withdraw. If Koinly asks you to enable those permissions, it is a red flag. It does not ask for them, and it should not need them.

Some exchanges allow you to restrict API keys by IP address. If your exchange offers this option, use it. Bind the key to Koinly's known IP ranges if available, or at minimum, do not allow access from arbitrary IP addresses. This adds a layer of protection if the key is stolen: it will only work when used from the approved IP range.

API Key Expiration and Maintenance

Expired or revoked API keys are the leading cause of Koinly connection errors. Keys do not last forever. They expire, get revoked during exchange security events, or stop working after an exchange API update. When that happens, Koinly can no longer retrieve transaction data, and your tax report becomes incomplete.

Some exchanges automatically expire API keys after a set period, often 90 or 180 days. Others revoke keys following a security incident like a password change or two-factor authentication reset. If you have not logged into Koinly in several months and you see sync errors when you return, the most likely cause is an expired or revoked API key.

The fix is straightforward: generate a new read-only API key on the exchange, delete the old key from Koinly, and add the new one. This is standard maintenance for any platform that uses API-based integrations. It is not a security failure. It is a feature: API keys that stop working after expiration or account changes reduce the window of exposure if a key is compromised without your knowledge.

If you are concerned about API key persistence, treat it like a password: rotate it regularly. Every six months, generate a new key, update Koinly, and revoke the old one. This limits the lifespan of any individual key and reduces the risk that a stolen key remains useful to an attacker over time.

How Koinly Compares to CoinLedger on Security History

CoinLedger, Koinly's primary competitor, experienced a data breach in 2020 affecting approximately 1,000 users. That breach exposed user email addresses and transaction data stored within CoinLedger's systems. The incident originated within CoinLedger's infrastructure, not through a third-party vendor.

Koinly's 2025 Mixpanel incident exposed email addresses and metadata through a vendor breach, but no transaction history or tax filings were compromised. The structural difference matters: CoinLedger's breach involved core financial data, while Koinly's involved only ancillary metadata shared with an analytics provider.

Both platforms now use read-only API access as the default connection model. Both encrypt API keys before storage. Both hold SOC 2 certifications. The practical security difference between them today is marginal. The historical record shows that both have experienced incidents, and both responded by tightening third-party vendor oversight and expanding security audits.

What this comparison tells you is that no tax platform is breach-proof. The question is not whether a platform has ever been involved in an incident. The question is what data was exposed, how the platform responded, and whether the structural design minimizes the damage if a future breach occurs. On that measure, both Koinly and CoinLedger use non-custodial models that prevent direct theft of user funds, even if account data is compromised.

What Happens If Koinly Is Breached Directly

If Koinly's primary infrastructure is compromised, the attacker gains access to the data stored in that infrastructure: encrypted API keys, transaction metadata, portfolio balances, and user account information. The encrypted API keys would need to be decrypted to be useful, which requires access to the decryption keys stored elsewhere in the system.

If those decryption keys are also obtained, the attacker now has usable API keys for connected exchanges. If those keys were created with read-only permissions, the attacker can view transaction history but cannot withdraw funds or place trades. If the keys were created with withdrawal permissions enabled, the attacker can initiate withdrawals directly from the user's exchange account.

This is why API permission scopes matter. Read-only keys limit the damage of a breach to privacy loss. Withdrawal-enabled keys turn a data breach into a fund-theft event. The security model you implement when creating the API key determines the worst-case outcome if Koinly is compromised.

For blockchain wallet connections, the risk is different. Koinly only stores public addresses, not private keys. If those addresses are exposed, an attacker can see transaction history and wallet balances, but they cannot move funds. The public address is already public. The breach exposes what is already visible on the blockchain to anyone who knows where to look.

The privacy risk is real. If your Koinly account links your real name to a set of wallet addresses, a breach that exposes that linkage has deanonymized your on-chain activity. For users in jurisdictions with capital controls or restrictive tax enforcement, this privacy loss has material consequences.

When Koinly's Risk Profile Changes

Koinly's risk profile depends on what you are using it for and where you are using it from. If you are a US or EU taxpayer using Koinly to generate annual tax filings with read-only API keys, the risk is limited to privacy loss and metadata exposure. Your funds cannot be stolen through Koinly because Koinly has no mechanism to move them.

If you are a user in a jurisdiction with capital controls and you are using Koinly to track cross-border stablecoin transfers, the privacy risk is higher. A breach that exposes your name, email, and linked wallet addresses could reveal to local authorities the full extent of your offshore holdings. This is not a Koinly-specific risk. It is a risk inherent in any platform that links your identity to your transaction history.

If you accidentally created API keys with withdrawal permissions and stored them in Koinly, your risk profile has shifted from privacy loss to direct fund theft. The platform itself will not misuse those permissions, but a compromised Koinly account now grants an attacker the ability to drain your exchange balance. The fix is immediate: revoke those keys, generate new read-only keys, and update Koinly with the corrected credentials.

The platform offers a free tier that allows you to import up to 10,000 transactions, connect unlimited wallets and exchanges, and preview your capital gains without payment. You only pay when you download an official tax report. This structure reduces financial risk: you can test the platform, verify its accuracy, and confirm that your API keys are configured correctly before committing to a paid plan.

The Actual Attack Surface

Koinly's actual attack surface consists of three layers: the API keys you generate and store in the platform, the transaction metadata the platform collects and analyzes, and the third-party vendors the platform integrates for analytics and infrastructure.

The API key layer is the highest-risk if misconfigured. Withdrawal-enabled keys are direct theft vectors. Read-only keys limit exposure to privacy loss. You control this layer entirely when you create the key on the exchange.

The transaction metadata layer is medium risk. If compromised, an attacker gains visibility into your trading history, portfolio composition, and linked wallet addresses. This does not enable fund theft, but it does expose financial activity that you may prefer to keep private. Users depositing into DeFi protocols or tracking stablecoin income flows should assume that any data stored in Koinly could become public in a breach scenario.

The third-party vendor layer is the least predictable. The Mixpanel incident demonstrated that data shared with external services can be exposed even when Koinly's primary infrastructure remains secure. Koinly has stated that it is auditing its third-party integrations following the incident, but there is no public list of which vendors currently have access to which data.

What you can control: API permission scopes, the decision to link wallet addresses to your account, and whether you store sensitive transaction history in the platform at all. What you cannot control: Koinly's internal security posture, the security practices of its third-party vendors, and whether AWS itself experiences a breach that exposes customer data.

When the Risk Is Worth It

The risk is worth it if the alternative is incomplete tax reporting, manual transaction tracking across dozens of wallets and exchanges, or errors in cost-basis calculation that result in overpayment or audit exposure. Koinly automates a process that is otherwise time-intensive and error-prone, particularly for users with activity across multiple chains, DeFi protocols, and centralized platforms.

For users earning stablecoin yield in high-inflation economies, the ability to accurately track cost basis and generate jurisdiction-specific tax filings is not optional. Tax authorities in Argentina, Turkey, and Nigeria are increasingly scrutinizing crypto income, and manual tracking of hundreds or thousands of transactions is not feasible for most individual users.

The risk is not worth it if you are holding assets in jurisdictions where capital controls make exposure of cross-border transfers a legal liability, or if you have enabled API keys with withdrawal permissions that you have not revoked. In those cases, the downside of a breach exceeds the benefit of automated tax reporting.

For most users, the correct approach is to use Koinly with read-only API keys, link only the wallets and exchanges necessary for tax compliance, and accept that the metadata you share with the platform could become public in a breach. That is the trade-off. The platform reduces operational burden and improves tax accuracy, but it introduces a new privacy and security dependency that did not exist when you were tracking transactions manually.

The Takeaway

Koinly is safe in the sense that it uses read-only API access, encrypts stored data, and does not hold custody of user funds. It is not safe in the sense that it has already experienced a third-party vendor breach, and any platform that stores API keys and transaction metadata is a potential target for attackers. The risk you face depends on what permissions you grant when you create your API keys, what data you choose to share, and whether you are operating in a jurisdiction where exposure of that data has legal consequences. The platform works as designed when you configure it correctly. The documented incident history shows that vendor risk is real, and that Koinly's response has been to tighten vendor oversight rather than to eliminate third-party integrations entirely. If you are using Koinly, verify your API key permissions today. If any key has withdrawal or trading permissions enabled, revoke it immediately and generate a new read-only key. That single step reduces your attack surface more than any other security measure the platform can implement.

Frequently Asked Questions

Can Koinly withdraw funds from my exchange account?

No. Koinly uses read-only API access, which means it can view transaction history but cannot place trades, withdraw funds, or modify your account. However, if you accidentally create an API key with withdrawal permissions enabled when setting up the connection, that key could become a theft vector if your Koinly account is compromised. Always verify that you enable only Read or View permissions when generating API keys for tax software.

What data did the Mixpanel breach in December 2025 expose?

The Mixpanel breach exposed email addresses, names, rough location data like city or country, and device metadata such as operating system and browser version. Koinly confirmed that no wallet information, transaction history, tax reports, or portfolio data was shared with Mixpanel or compromised in the incident. The breach occurred at a third-party analytics vendor, not within Koinly's primary infrastructure.

Does Koinly store my private keys or seed phrases?

No. Koinly only requires public wallet addresses to track blockchain transactions. It never asks for private keys or seed phrases because it does not need signing permissions or the ability to move funds. For exchange connections, Koinly stores encrypted API keys that you generate on the exchange, but those keys should be configured as read-only and do not include private key material.

How often should I rotate my API keys connected to Koinly?

Rotating API keys every six months is a reasonable security practice. Many exchanges automatically expire API keys after 90 to 180 days, and some revoke keys following account security events like password changes. Regular rotation limits the lifespan of any individual key and reduces the window of exposure if a key is compromised without your knowledge. When you rotate, generate a new read-only key on the exchange, update Koinly, and revoke the old key immediately.

What happens if Koinly is directly breached?

If Koinly's infrastructure is compromised, an attacker could access encrypted API keys, transaction metadata, portfolio balances, and user account information. If decryption keys are also obtained and your API keys were created with withdrawal permissions, an attacker could initiate withdrawals from your exchange account. If your keys are read-only, the breach exposes transaction history and privacy but does not enable fund theft. For blockchain wallets, Koinly only stores public addresses, so a breach would not grant access to move your funds.