CoinStats review: a good tracker with a breach in its file

A portfolio tracker is a simple idea with a hard security profile. To be useful it must connect to your exchanges, read your wallets and aggregate everything in one place. That aggregation is the product, and it is simultaneously a single target containing a complete map of your financial position.

June 2024

CoinStats disclosed a security incident in which attackers compromised part of its infrastructure and drained assets from around 1,590 user wallets, with losses estimated in the low single-digit millions of dollars. The company suspended the application, published updates through the incident and worked through remediation publicly.

The handling was reasonable by the standards of this industry. The exposure is the point: wallets connected through the service were reachable, and users who believed they had connected a read-only view learned that they had not.

A read-only connection cannot lose your funds. Anything more than read-only is a wallet the service can touch, whatever the interface calls it.

How to connect it, if you do

1. Exchange API keys: read-only, no trading, no withdrawal. Verify the permissions on the exchange side, not in the tracker's wording.

2. Wallets: public address only. Never import a private key or seed phrase into any tracker, ever, for any reason.

3. Review connected integrations periodically and remove the ones you no longer use.

4. Use a separate email for tracker accounts so a breach does not link to your exchange logins.

Followed properly, the worst case from a tracker breach is that somebody learns what you hold. That is a privacy problem, and privacy problems in crypto have physical consequences — but it is not a solvency problem.

The product itself

Coverage is genuinely broad, including DeFi positions that most trackers simply do not see — liquidity positions, staked assets and lending balances shown as positions rather than as a mysteriously missing balance.

The mobile app is fast and the home-screen widgets are among the better implementations in the category. For someone with assets spread across six venues and three chains, the aggregation saves real time every week.

Pricing

A free tier covers a limited number of connections. Paid plans start around $14 a month and rise for higher limits and additional features.

Tax reporting

There is a tax module. It is weaker than Koinly, CoinLedger or CoinTracker, with narrower jurisdiction support and less reliable classification of anything unusual. Use CoinStats to watch the portfolio and a dedicated tool to file — the two jobs are less similar than they look.

Verdict

Why a tracker is worth having at all

Assets scattered across six venues and four chains are assets you will eventually mis-count. People routinely forget a position entirely, discover a staked balance years later, or believe they are diversified while holding the same exposure three times under different names.

An aggregated view fixes that, and the fix is worth more than the subscription. It is also worth more than the marginal risk of a read-only connection, provided the connection genuinely is read-only.

Privacy, which nobody thinks about

A tracker with your exchange keys and your wallet addresses knows more about your finances than your bank does. It knows what you hold, where, how much, and how that changed over time — and it holds that alongside the same data for everybody else who signed up.

That concentration is attractive to attackers for reasons that have nothing to do with moving funds. A list of addresses and balances tied to email accounts is directly useful for targeted phishing and, in a small number of documented cases, for physical coercion. Use an address you do not use elsewhere, and think about whether every wallet needs to be in the aggregate view.

Alternatives worth comparing

• A spreadsheet: free, private, no connection risk, and nobody maintains it past February.

• DeBank or a chain-native tracker: better on-chain depth, no exchange connections, no subscription.

• Your exchange's own portfolio view: accurate for that exchange and blind to everything else.

CoinStats wins on breadth — exchanges and chains in one view. That breadth is the product, and it is also precisely the thing that made the 2024 incident matter. Connect it accordingly.

Score: 6.5. A capable tracker with the widest DeFi visibility in this category, marked down for a breach that reached user funds and for a tax module that should not be the reason you choose it. Connect it read-only, and it is a useful piece of software.