CoinGecko
Crypto price and market data for tokens, exchanges and categories; independent aggregator running since 2014.
Security record: 3 incidents- Tracks over 22,000 crypto assets across more than 1,000 exchanges
- Portfolio tracks holdings and P&L per coin, with wallet tracking and multiple portfolios
- Candy rewards for using the site, redeemable for discounts, vouchers and raffle entries
- Free public API; GeckoTerminal, its sister site, covers live onchain DEX charts
- Premium removes ads, raises wallet tracking from 2 to 100 and lifts the 500 manual transaction limit
Six criteria, each 1 to 5 from the facts on this page, weighted into one score inside its category. How we score
- Depth
- 22,000+ assets across 1,000+ exchanges
- Cost
- Free site and portfolio; Premium 10 USD a month lifts wallets from 2 to 100
- Ease
- Browse without sign-up; mobile app with alerts; free public API
- Trust
- Read-only data site, independent since 2014
- Access
- Open to browse; free account for portfolio and Candy
- Rewards
- Candy points for using the site, redeemable for vouchers and raffles
Cost to start: Free; Premium is 10 USD a month or 99.9 USD a year, with a 14-day trial
- Create a free account and log in
- Build a portfolio by adding coins or tracking a wallet
- Collect Candy and redeem it in the Candy shop
- Turn on alerts for portfolio coins in the mobile app
3 incidents
Past incidents 3
Email vendor GetResponse breach leaked 1.9M contacts. An attacker compromised a GetResponse employee account and exported 1,916,596 contacts from CoinGecko's mailing list (names, emails, IP addresses, email-open locations, plan metadata). The attacker sent 23,723 phishing emails from another GetResponse client's account; CoinGecko said accounts and passwords were not affected. CoinGecko notified affected users by email; no compensation mentioned (reported by The Block). https://www.theblock.co/news/regulation/2024-06-07-attacker-sends-nearly-24000-phishing-emails-derived-from-compromised-coingecko-third-party-email-platform-299099
Third partyRefund not stated
Sources: theblock.co, cointelegraph.com
CoinGecko and GeckoTerminal X accounts hijacked. Attackers posted a fake GCKO token airdrop with a phishing link from the @CoinGecko and @GeckoTerminal X accounts. CoinGecko said a team member clicked a fraudulent Calendly link that granted app access despite 2FA; control was regained within hours. CoinGecko apologized but no compensation statement was found; at least one user reported a drained wallet (The Block). https://www.theblock.co/post/271662/coingeckos-x-account-hacked-posts-fraudulent-token-airdrop
Partly own faultRefund not stated
Sources: theblock.co, cointelegraph.com
Malicious Coinzilla ad script showed wallet popups. Visitors of CoinGecko, Etherscan and DEXTools were prompted to connect MetaMask to the phishing domain nftapes.win. CoinGecko attributed it to a malicious ad script served by the ad network Coinzilla and disabled the script. No compensation statement found; CoinGecko only said it disabled the Coinzilla script (reported by The Block). https://www.theblock.co/linked/146937
Partly own faultRefund not stated
Sources: theblock.co
From the project’s statements and security coverage. Own fault means the project’s code, servers or keys; third party means a vendor, registrar, oracle or issuer it relies on.
