Coinbase Wallet connects to dApps via three methods — Browser Extension, QR Code (Wallet SDK), and WalletConnect.
Connection shares only the public address — private keys never leave the device, and every on-chain transaction still requires explicit user approval.
| Entity | Role | Layer |
|---|---|---|
| Coinbase Wallet | Wallet provider | Core |
| WalletConnect | Cross-platform connection protocol | Connection |
| Browser Extension | Desktop browser injection | Connection |
| Wallet SDK | Encrypted mobile-to-desktop bridge | Connection |
| Token Approval | Smart contract spending permission | Security |
Approval Phishing Is CommonCoinbase identified approximately 20,000 approval-phishing victims and froze $12 million in stolen assets during 2025. Token approvals remain active on-chain even after disconnecting — they must be revoked manually.
A dApp connection grants read access to the public address and token balances only — it does not grant fund transfer rights. Every transaction still requires a separate user signature since smart contracts can’t execute automatically without wallet approval.
| Access Type | dApp Can | dApp Cannot |
|---|---|---|
| Wallet data | Read Public Address | Access private keys or seed phrase |
| Balances | Read token balances per chain | Transfer tokens without approval |
| Transactions | Request transaction signature | Execute without confirmation |
| Token Approvals | Request spending limit | Exceed the approved limit |
| Action | Scope | Reversible | Risk |
|---|---|---|---|
| dApp Connection | Public Address read access | Disconnect anytime | Low |
| Token Approval | Smart Contract spending rights | Revoke via Revoke.cash | High if unlimited |
| Transaction Signature | One specific on-chain action | Irreversible | High |
| Method | Speed | Security | Device |
|---|---|---|---|
| Browser Extension | High | Medium – desktop hot wallet | Desktop only |
| QR Code (Wallet SDK) | Medium | High – biometric on mobile | Mobile + Desktop |
| WalletConnect | Medium | High – encrypted session | Cross-platform |
The Browser Extension injects window.ethereum into desktop browsers for direct connectivity. Wallet SDK creates an encrypted bridge between the mobile app and desktop browsers. WalletConnect v2 supports multi-chain sessions through a single connection.
Get it from the official Chrome Web Store, Brave Store, Firefox Add-ons, or Edge Add-ons marketplace.
Visit a supported decentralized application such as Uniswap, Aave, or OpenSea.
Click Connect Wallet, select Coinbase Wallet from the options.
Check the dApp name and URL carefully in the popup, then click Approve.
Verify the URL Every TimePhishing sites mimic legitimate dApps — one character difference in the URL routes to a malicious Token Approval. Always check the domain before clicking Connect Wallet.
Click Connect Wallet and select Coinbase Wallet.
Open the mobile app, tap the three-dot menu → Scan, and scan the code on desktop.
Review the connection request and approve to establish the encrypted session.
Wallet SDK (formerly WalletLink) generates a single-use session key that can’t be intercepted since it expires after scanning. Biometric authentication approves each subsequent transaction on the mobile device.
Open the app → Settings → scroll to WalletConnect → tap “Connect to a dApp” → scan the dApp’s QR code → confirm on both devices.
Click Connect Wallet on the dApp → select WalletConnect → a QR code appears → open Coinbase Wallet, tap Scan → scan and approve.
| WalletConnect Version | Multi-chain | dApps Supported | Session Persistence |
|---|---|---|---|
| v1 (deprecated) | Single chain | 4,000+ | Per session |
| v2 (current) | Multi-chain | 6,000+ | Persistent until revoked |
| Blockchain Type | Browser Extension | QR Code | WalletConnect |
|---|---|---|---|
| Ethereum + EVM chains | Yes | Yes | Yes |
| Solana | Yes | Yes | Yes |
| Non-EVM (Bitcoin) | No | No | Limited |
| Layer 2 (Base, Arbitrum, Optimism) | Yes | Yes | Yes |
Approval phishing tricks users into signing a Token Approval that grants a malicious smart contract unlimited access to their token balance.
| Step | Action | Risk |
|---|---|---|
| 1 | User visits phishing site mimicking a legitimate dApp | URL typosquatting |
| 2 | User connects wallet — shares Public Address | Low risk at this step |
| 3 | Phishing dApp requests unlimited Token Approval | Critical risk point |
| 4 | User approves — contract gains unlimited access | Wallet drained |
| 5 | Attacker calls the contract — transfers entire balance | Irreversible loss |
Disconnecting ends the active session. Revoking cancels smart contract spending rights on-chain. Both steps are required for complete permission removal.
Or use etherscan.io/tokenapprovalcheck for an Ethereum-only view.
Connect Coinbase Wallet and review all active token approvals across each chain.
Click Revoke on any unlimited or suspicious approval, then confirm and pay the gas fee.
Mobile: Settings → Connected dApps → tap the dApp → Disconnect.
Browser Extension: Settings → Connected Sites → click the X next to the dApp.
Monthly token approval reviews are recommended for active DeFi users to reduce long-term exposure to compromised smart contracts.
| Cause | Symptom | Fix |
|---|---|---|
| Outdated Browser Extension | Popup doesn’t appear | Update the extension |
| Wrong network selected | Connected but transactions fail | Switch to the dApp’s required chain |
| Expired WalletConnect QR | QR scan rejected | Regenerate — sessions expire in ~5 min |
| Multiple wallets conflicting | MetaMask overrides Coinbase Wallet | Disable other wallet extensions |
| Browser cache conflict | Previous session error | Clear cache and cookies, reconnect |
Visit the dApp, click Connect Wallet, and select Coinbase Wallet. On desktop, use the Browser Extension or scan the QR code with the mobile app. Connection shares Public Address only — no fund access granted.
Open Coinbase Wallet, tap Settings, scroll to WalletConnect, tap Connect to a dApp, and scan the dApp’s QR code. Alternatively, select WalletConnect on the dApp and scan with Coinbase Wallet.
No. Connection shares only Public Address and token balances — read access only. A dApp cannot transfer funds without explicit approval per transaction, or a Token Approval up to a specific amount.
Mobile: Settings → Connected dApps → select the dApp → Disconnect. Browser Extension: Settings → Connected Sites → click X. Disconnecting doesn’t revoke Token Approvals — revoke those separately via Revoke.cash.
Visit revoke.cash, connect Coinbase Wallet, view all active approvals across 100+ EVM chains, and click Revoke next to each unwanted approval. Each revocation costs one gas fee.
Connecting to legitimate dApps is safe — only Public Address is shared. Risk comes from phishing sites requesting unlimited Token Approvals. Verify the URL, reject unlimited approvals, and revoke suspicious ones monthly.
