APR4.53%(Variable)
Risk score90High
Coinbase relaunched its Bitcoin-backed lending service in early 2025, partnering with Morpho on Base to offer U.S. users (excluding NY) over‐collateralized USDC loans up to $100 K with flexible repayment terms.
Interest rate
Variable (e.g. 4.53%)
Currency support
USDC
Fees
0%
Collateral
cbBTC
LTV
Up to 75%
Loan type
Consumer
Liquidation LTV
86%
Margin call
N/A
KYC
Yes
Total loan issued
N/A
Launch year
2025
Loan duration
Flexible
Support
Email, Phone, Chat
Loan value
N/A
Total risk score90High
Collateral
4/10
What are you pledging? Native BTC is safest; wrappers, bridges, or paper IOUs add redemption risk.
BTC is withdrawn from your Coinbase account, wrapped into cbBTC and deposited to a Morpho smart-contract vault – i.e., an ERC-20 representation, not native UTXOs.
Rehypothecation
2/10
Will your BTC be re-used? More hidden leverage → bigger blow-up chance.
Coinbase doesn’t reuse customer crypto without consent; cbBTC is locked in a Morpho contract and not rehypothecated. All borrower collateral is pooled in a single Morpho Blue market.
Custody
4/10
Who can move the coins? Scores quorum design, recovery paths, and (for CeFi) bankruptcy-remote segregation.
Coinbase’s Bitcoin-backed loans are treated as mainly “CeFi” because the BTC that backs cbBTC is held by a centralized custodian (Coinbase Custody). Because the product uses a wrapped asset, it introduces two custody layers. We split them in the model: the centralized custodian exposure is captured in Collateral = 4, while the cbBTC that borrowers pledge is commingled inside a single, immutable Morpho Blue vault, so the DeFi ladder assigns Custody = 4.
Security & Governance
7/10
How battle-tested are code and ops? Counts audits, bug-bounty, certs, and hardware key isolation.
Morpho’s lending code has undergone dozens of public audits (Spearbit, OpenZeppelin, Runtime Verification) and is covered by a large bug-bounty program. Borrower keys come from Coinbase Smart Wallet passkeys; the on-chain wallet contract is open-source and audited, but the mobile/browser client remains closed-source and non-reproducible. Coinbase cosigner keys reside in HSM-backed cold storage, yet Chainlink oracle-signer key custody is undisclosed. A Chainlink mis-price on 29 May 2025 (deUSD at $1.03) wiped out ≈ $500 k on Avalanche, highlighting single-provider risk. Together these gaps place Coinbase-Morpho at Security & Governance = 7.
Platform
7/10
Is the chain or bridge robust? Rates consensus security and smart-contract attack surface.
Coinbase-Morpho's Bitcoin-backed loan service runs on Base. Base is an Ethereum Layer-2 optimistic roll-up that posts its batches to Ethereum mainnet for final settlement and security. All in-flight transactions are ordered by a single sequencer operated by Coinbase, so liveness depends on one centralized node. That sequencer has already faltered once: on 5 September 2023 block production stopped for about 43 minutes before engineers restored the chain. Ethereum itself once executed a state-reversing hard fork after the 2016 DAO exploit.
Oracle
4/10
How is price fetched and signed? Independence, on-chain proofs, refresh speed, circuit breakers.
Coinbase-Morpho pulls price data from a single on-chain Chainlink feed (via MorphoChainlinkOracleV2) for both BTC/USD and cbBTC/BTC. Chainlink is an independent, publicly auditable oracle, satisfying the “one independent feed” criterion, but the lack of a second source keeps the score above 2. The 29 May 2025 deUSD mis-price, which triggered ≈ $500k of liquidations on Avalanche when Chainlink’s VWAP logic flagged a stray trade, underscores why single-provider dependence is risky.
Liquidation Buffer
4/10
How much room and time before liquidation? Combines LTV gap, grace window, and flash-crash guards.
Max LTV 75% (email notice), liquidation at 86% → 11 pp buffer. No grace window. LTV moves continuously per loan within set guardrails.
Rate & Term
7/10
Can interest spike mid-loan? Looks at fixed vs variable APR and funding duration match.
Interest “varies every few seconds with each block” under Morpho’s AdaptiveCurve IRM; no APR cap or notice period.
Transparency
4/10
Can outsiders verify code & solvency? Rewards open-source + live PoR; punishes black boxes.
Coinbase gives continuous, on-chain asset proof for cbBTC, but no comparable proof of liabilities and only partial, non-reproducible source-code openness.
Loan Currency
4/10
What asset do you borrow? Native-BTC best; fiat stables graded on reserves, audits, censorship risk.
Loans are disbursed in USDC.
Privacy
10/10
How exposed is your identity? Scores KYC depth, data storage, and breach history.
Coinbase requires full photo-ID KYC for all customers; data is stored on centralized infrastructure.
History
4/10
Have they proven themselves? Measures years live, audit/OSS footprint, and incident track record.
One significant event inside 5-year window: May 2025 data-breach/extortion (PII leak); no loss of customer funds.
Jurisdiction
2/10
Which legal system backs you? Rates clarity of licensing, creditor rights, and enforcement.
US MSB/NYDFS qualified custodian, SEC-registered public company.