Coinbase Wallet Extension: what it is and how to get started

Coinbase Wallet is a self-custody wallet: the keys that control your assets are generated on your device and stay there. The extension is the desktop-browser version of that wallet, built for Chromium-based browsers and Firefox. It gives you two things at once — a place to hold and manage crypto, and a bridge between your browser and decentralised applications (dapps).

That second job is the reason extensions exist. A website cannot reach into your wallet on its own; it has to ask the extension for permission. The extension shows you the request, you decide, and only then does the site learn your address or receive a signed transaction. In practice this replaces the older, riskier workflow of copying a long address from one screen into another.

Extension, mobile app and exchange account

These are three different things that share a brand name, and mixing them up causes most beginner confusion.

The feature set is broad, but most people use a handful of things: hold assets, see one portfolio, connect to dapps, swap, and manage NFTs.

For a closer look at each capability, including what the wallet deliberately does not do, see the feature guide.

Under the friendly interface there are four moving parts worth understanding, because each one is where a scam tries to insert itself.

1. A key pair stored on your device

When you create a wallet, the extension generates a private key and the matching public address. The private key is encrypted with your wallet password and kept in the browser's extension storage on your machine. Your password protects the local copy; it is not what recovers the wallet. Only the recovery phrase can do that.

2. A connection layer for websites

A dapp detects a browser wallet and asks for a connection. The extension shows you the origin of the request and which address would be shared. Approving shares your public address only. From then on, the site can ask for signatures and transactions — and each one still needs your explicit approval.

3. Network endpoints (RPC)

Balances and transaction data come from network nodes the wallet is configured to talk to. If those endpoints are slow or a dapp is pointed at a different network than your wallet, you get the classic "wrong network" or "balance looks empty" problems described in troubleshooting.

4. Your approval is the last line of defence

Every irreversible action passes through a prompt with an approve and reject button. A deliberate two-second pause at that prompt — reading what is being signed, and on which network — prevents more losses than any other habit.

The extension is a desktop-browser tool. Mobile browsers do not support extensions at all, which is why Coinbase Wallet also ships a phone app for the same wallet.

Networks

A browser wallet of this kind is multi-network. In practice that means Ethereum and the EVM-compatible chains people use most — Base, Polygon, Arbitrum, Optimism, Avalanche, BNB Chain and others — plus Solana and Bitcoin support that has been added over time. The exact, current list changes as networks launch, so treat the wallet itself and Coinbase's official documentation as the source of truth rather than any third-party blog, including this one.

• Each network has its own fee token — you need the native coin of a network to move anything on it.
• The same wallet address looks different on non-EVM networks; always check the address the wallet displays for that chain.
• If a dapp insists on a network you have no funds on, switch networks in the extension or reject and reconsider.

• Start from an official page, never a search result or an ad. Typing the brand name into a search engine and clicking the first sponsored link is how people end up with a look-alike extension.
• Check the publisher on the store listing. The developer should be Coinbase, the listing old, the user count very large and the update history recent.
• Read the permissions. A wallet needs to read and change data on pages you visit so it can talk to dapps. Extra permissions unrelated to that are a warning sign.
• Have a pen and paper ready. You will be shown a recovery phrase once. It is meant to be written down, offline.
• Set aside a quiet five minutes. Rushing setup is how people skip the backup step they cannot undo.

The full sequence, including what a genuine prompt looks like at each stage, is in the setup walkthrough.

• Your recovery phrase never goes online. Not in a screenshot, not in cloud notes, not in a password manager's notes field, not in a chat with "support".
• Nobody legitimate will ever ask for it. Not Coinbase, not a dapp, not a giveaway, not an "airdrop fix" agent in a direct message.
• Verify the site you are connected to before approving anything, and check the network in the prompt matches the action you intended.
• Review approvals every few months and revoke what you no longer use.
• Consider a hardware wallet for anything you would be upset to lose; the extension can work with one.
• Keep the extension updated so you get security fixes as they ship.

There is a longer version, with the scam patterns worth recognising, in the security guide.

See all 15 questions