CoinMarketCap
Crypto price rankings, token profiles, watchlists and DEX data via DexScan; live since 2013 and does not sell crypto itself.
Security record: 2 incidents- Price rankings and token pages for millions of listed crypto assets
- Watchlist and Portfolio; the portfolio reads onchain balances for EVM chains, Bitcoin and Cardano and connects to Binance and OKX
- DexScan covers DEX pairs on more than 70 networks, with a New Pairs page and security checks
- Campaigns section with Airdrops, Learn & Earn and Diamond Rewards, a loyalty program you redeem for listed rewards
- Free Basic API plan; paid API plans start at 29 USD a month
Six criteria, each 1 to 5 from the facts on this page, weighted into one score inside its category. How we score
- Depth
- Millions of listed assets; DexScan covers DEX pairs on 70+ networks
- Cost
- Free site, watchlist and portfolio; only the API has paid plans
- Ease
- Browse without sign-up; iOS and Android apps; free Basic API
- Trust
- June 2025: homepage showed a wallet drainer popup; CMC confirmed and removed it
- Access
- Open to browse; free account for watchlist and portfolio
- Rewards
- Diamond Rewards points plus an Airdrops page for listed projects
- Create a free account
- Add tokens you farm to your Watchlist
- Add your wallets or exchange accounts to the Portfolio
- Use DexScan New Pairs to look up fresh DEX tokens
- Check the Campaigns menu for Airdrops and Learn & Earn
2 incidents
Past incidents 2
Homepage doodle served fake wallet-verify popup. Around 21:00 UTC on 20 June 2025 a homepage doodle loaded an external resource via an API call that injected a CoinMarketCap-branded 'verify wallet' popup running a drainer. CoinMarketCap said it identified and removed the malicious code within hours; MetaMask and Phantom briefly flagged the site. CoinMarketCap's X statement covered removal and investigation only, no compensation mentioned (quoted by CoinDesk). https://coindesk.com/tech/2025/06/21/coinmarketcap-briefly-exploited-with-wallet-phishing-pop-up-message
Partly own faultUsers lost about $43,266Refund not stated
Sources: coindesk.com, bleepingcomputer.com, cside.dev
3.1M user email addresses traded on hacking forums. About 3.1 million email addresses of CoinMarketCap accounts were found traded on hacking forums and added to Have I Been Pwned on 22 Oct 2021; no passwords were included. CoinMarketCap said the list matched its user base but that it found no trace of a breach of its servers. Email exposure only; CoinMarketCap's blog said the leak did not come from its servers (quoted by Decrypt). https://decrypt.co/84242/3-million-coinmarketcap-emails-surface-online-but-no-trace-of-security-breach
Fault disputedNo user losses
Sources: haveibeenpwned.com, decrypt.co
From the project’s statements and security coverage. Own fault means the project’s code, servers or keys; third party means a vendor, registrar, oracle or issuer it relies on.
