Prime Broker Agreement

Exhibit 10.1

Certain confidential information contained in this document, marked by [***], has been omitted because the registrant has determined that the information (i) is not material and (ii) is of the type that the registrant treats as private or confidential.

COINBASE PRIME BROKER AGREEMENT

General Terms and Conditions

This agreement (including, the Coinbase Custody Custodial Services Agreement attached hereto as Exhibit A (the “Custody Agreement”), the Coinbase Settlement and Transfer Agreement attached hereto as Exhibit B (the “STA”), and all other exhibits, addenda and supplements attached hereto or referenced herein, collectively, the “Coinbase Prime Broker Agreement”), is entered into by and between Grayscale Bitcoin Mini Trust (BTC) (“Client”), Grayscale Investments LLC (“Sponsor”) , and Coinbase, Inc. (“Coinbase”), on behalf of itself and as agent for Coinbase Custody Trust Company, LLC (“Coinbase Custody” or “Trust Company”), and, as applicable, Coinbase Credit, Inc. (“Coinbase Credit,” and collectively with Coinbase and Coinbase Custody, the “Coinbase Entities”). This Coinbase Prime Broker Agreement sets forth the terms and conditions pursuant to which the Coinbase Entities will open and maintain the prime broker account (the “Prime Broker Account”) for Client and provide services relating to custody and other services (collectively, the “Prime Broker Services”) for certain digital assets (“Digital Assets”) as set forth herein. Client and the Coinbase Entities (individually or collectively, as the context requires) may also be referred to as a “Party”. Capitalized terms not defined in these General Terms and Conditions (the “General Terms”) shall have the meanings assigned to them in the respective exhibit, addendum, or supplement. In the event of a conflict between these General Terms and any exhibit, addendum, or supplement hereto, then the document governing the specific relevant Prime Broker Service shall control in respect of such Prime Broker Service.

Although executed as of the date hereof, this Coinbase Prime Broker Agreement shall not become effective until the date on which shares of Grayscale Bitcoin Mini Trust (BTC) begin trading on NYSE Arca as shares of an exchange-traded product.

Client acknowledges that the Coinbase Entities may have actual or potential conflicts of interest in connection with providing the Prime Broker Services including that Coinbase does not engage in front-running, but is, or may be, aware of pending movements of Digital Assets, and may execute a trade for its own inventory (or the account of an affiliate) while in possession of that knowledge. As a result of these and other conflicts, the Coinbase Entities may have an incentive to favor their own interests and the interests of their affiliates over a particular Client’s interests and have in place certain policies and procedures in place that are designed to mitigate such conflicts. Coinbase will maintain appropriate and effective arrangements to eliminate or manage conflicts of interest, including segregation of duties, information barriers and training. Coinbase will notify Client in accordance with the notice provisions hereof of changes to its business that have a material adverse effect on Coinbase’s ability to manage its conflicts of interest.

Client authorizes Coinbase to combine information regarding all Prime Broker Services activities into a single statement. Coinbase will provide Client with an electronic account statement every month, at a minimum. Each account statement will identify the amount of cash and each Digital Asset in Client’s Prime Broker Account at the end of the period and set forth all Prime Broker Account activity during that period. Client shall have on demand access to its account information on the Coinbase Prime Broker site subject to section 8.1 and availability of the Prime Broker site.

Client represents, warrants, and covenants that:

2

3

Coinbase, on behalf of itself and each other Coinbase Entity, represents, warrants, and covenants that:

4

5

6

Client Assets in the Settlement Balance and Vault Balance (as defined hereinafter) will be treated as “financial assets” under Article 8 of the New York Uniform Commercial Code (“Article 8”). Coinbase and Coinbase Custody are “securities intermediaries,” the Settlement Balance and Vault Balance are each “securities accounts,” and Client is an “entitlement holder” under Article 8. This Agreement sets forth how the Coinbase Entities will satisfy their Article 8 duties. Treating Client Assets in the Settlement Balance and Vault Balance as financial assets under Article 8 does not determine the characterization or treatment of the cash and Digital Assets under any other law or rule. New York will be the securities intermediary’s jurisdiction with respect to Coinbase and Coinbase Custody, and New York law will govern all issues addressed in Article 2(1) of the Hague Securities Convention. Coinbase and Coinbase Custody will credit the Client with any payments or distributions on any Client Assets it holds for Client’s Settlement Balance and Vault Balance. Coinbase and Coinbase Custody will comply with Client’s Instructions with respect to Client Assets in Client’s Settlement Balance or Vault Balance, subject to the terms of the STA or Custody Agreement, as applicable, and related Coinbase rules. Neither Coinbase nor Coinbase Custody may grant a security interest in the Digital Assets in either the Settlement Balance or Vault Balance, respectively. Digital Assets in Client’s Custodial Account are custodial assets. Under Article 8, the Digital Assets in either the Settlement Balance or Vault Balance are not general assets of Coinbase or Coinbase Custody, respectively and are not available to satisfy claims of creditors of Coinbase or Coinbase Custody, respectively. Coinbase and Coinbase Custody will comply at all times with the duties of a securities intermediary under Article 8, including those set forth at sections 8-504(a), 8505(a), 8-506(a), 8-507 and 8-508, in accordance with the terms of this Coinbase Prime Broker Agreement.

7

“Coinbase,” “Coinbase Prime,” “prime.coinbase.com,” and all logos related to the Prime Broker Services or displayed on the Coinbase Prime Broker Site are either trademarks or registered marks of the Coinbase Entities or their licensors. Client may not copy, imitate or use them without Coinbase’s prior written consent. The license granted under this Section 8.1 will automatically terminate upon termination of this Coinbase Prime Broker Agreement, or the suspension or termination of Client’s access to the Coinbase Prime Broker Site or Prime Broker Services.

8

9

10

Client agrees that its use of data made available to it through the application programming interface(s) of the Prime Platform (as defined in the STA), which may include the prices and quantities of orders and transactions executed on the Prime Platform (collectively “Market Data”), is subject to the Market Data Terms of Use, as amended and updated from time to time at https://www.coinbase.com/legal/market_data or a successor website.

For compliance and monitoring purposes, Client authorizes each Coinbase Entity at its sole discretion to record conversations between such Coinbase Entity and Client or its Authorized Representatives relating to this Coinbase Prime Broker Agreement, the Prime Broker Account and the Prime Broker Services.

11

The Coinbase Entities have implemented and will maintain a reasonable information security program (as summarized in the Security Addendum attached hereto) that includes policies and procedures that are reasonably designed to safeguard Coinbase Entities’ electronic systems and Client’s Confidential Information from, among other things, unauthorized access or misuse. In the event of a Data Security Event (defined below), the applicable Coinbase Entity shall promptly (subject to any legal or regulatory requirements) notify Client in writing at the email addresses listed in Section 33 and such notice shall include the following information: (i) the timing and nature of the Data Security Event, (ii) the information related to Client that was compromised, including the names of any individuals’ acting on Client’s behalf in his or her corporate capacity whose personal information was compromised, (iii) when the Data Security Event was discovered, and (iv) remedial actions that have been taken and that the applicable Coinbase Entity plans to take. “Data Security Event” is defined as any event whereby: (a) an unauthorized person (whether within Coinbase or a third party) acquired or accessed Client’s information; (b) Client’s information is otherwise lost, stolen or compromised.

The Trust Company will respond to any periodic request from Client regarding the identity of the Trust Company’s then employed Chief Information Security Officer, or other senior security officer of a similar title; such requests may be made by Client monthly.

For the year 2023, and for each year thereafter, no more than once per calendar year, Client shall be entitled to request that Coinbase provide a copy of its most recent Services Organization Controls (“SOC”) 1 report and SOC 2 report, (together, the “SOC Reports”), and promptly deliver to Client a copy thereof by December 31 of each year. The SOC 1 and SOC 2 reports shall not be dated more than one year prior to such request. Coinbase reserves the right to combine the SOC 1 and SOC 2 reports into a comprehensive report. In the event that Coinbase does not deliver a SOC 1 Report or SOC 2 Report, as applicable, Client shall be entitled to terminate this Coinbase Prime Broker Agreement. Client may also request letters of representation regarding any known changes or conclusions to the SOC Reports on a quarterly basis between SOC reports (“SOC Bridge Letters”).

The Coinbase Entities have established a business continuity plan that will support their ability to conduct business in the event of a significant business disruption. The business continuity plan is reviewed and updated annually, and may be updated more frequently as deemed necessary by the Coinbase Entities in their sole discretion. To receive more information about the Coinbase Entities’ business continuity plan, please send a written request to [***].

Client hereby acknowledges, that: (i) Digital Assets are not legal tender, are not backed by any government, and are not subject to protections afforded by the Federal Deposit Insurance Corporation or Securities Investor Protection Corporation; (ii) Legislative and regulatory changes or actions at the state, federal, or international level may adversely affect the use, transfer, exchange, and/or value of Digital Assets; (iii) transactions in Digital Assets are irreversible, and, accordingly, Digital Assets lost due to fraudulent or accidental transactions may not be recoverable; (iv) certain Digital Assets transactions will be deemed to be made when recorded on a public blockchain ledger, which is not necessarily the date or time that Client initiates the transaction or such transaction enters the pool; (v) the value of Digital Assets may be derived from the continued willingness of market participants to exchange any government issued currency (“Fiat Currency”) for Digital Assets, which may result in the permanent and total loss of value of a Digital Asset should the market for that Digital Asset disappear; (vi) the volatility of the value of Digital Assets relative to Fiat Currency may result in significant losses; (vii) Digital Assets may be susceptible to an increased risk of fraud or cyber-attack; (viii) the nature of Digital Assets means that any technological difficulties experienced by a Coinbase Entity may prevent the access or use of Client Digital Assets; and (ix) any bond or trust account maintained by Coinbase Entities for the benefit of its customers may not be sufficient to cover all losses (including Losses) incurred by customers.

12

“Affirmative Action” is defined as the Sponsor’s written notification to Coinbase of Client’s intention (i) to acquire and/or retain an Incidental Asset or (ii) to abandon, with effect prior to the relevant Creation Time or Redemption Time, an Incidental Asset.

“Incidental Asset” is defined as any digital asset or other asset, and any right of Client to acquire any digital asset or other asset, that has arisen out of Client’s ownership of Digital Assets, whether through a fork, airdrop or similar occurrence, without any action on the part of Client or its trustee or the Sponsor on its behalf.

13

Upon the occurrence of a default or an event of default under an agreement with a Coinbase Entity (including an “Event of Default” as such term is defined in the Post Trade Financing Agreement, if applicable (in each case, at maturity, upon acceleration or otherwise) or the occurrence of an event that constitutes “Cause” (as defined below) (each, a “Setoff Event”), each Coinbase Entity may setoff and net the amounts due from it or any other Coinbase Entity to Client and from Client to it or any other Coinbase Entity, so that a single payment (the “Net Payment”) shall be immediately due and payable by the Sponsor on behalf of the Client or the Coinbase Entity to the other (subject to the other provisions hereof and of any agreement with a Coinbase Entity). If any amounts cannot be included within the Net Payment, such amounts shall be excluded but may still be netted against any other similarly excluded amounts. Upon the occurrence of a Setoff Event, each Coinbase Entity may also: (a) liquidate, apply and setoff any or all Sponsor Assets (as such term is defined in the STA) against any Net Payment, unpaid trade credits, or any other obligation owed by Client to any Coinbase Entity; and (b) setoff and net any Net Payment or any other obligation owed to the Client by any Coinbase Entity against: (i) any or all collateral or margin posted by any Coinbase Entity to Client (or the U.S. dollar value thereof, determined by Coinbase in its sole discretion on the basis of a recent price at which the relevant Digital Asset was sold to customers on the Prime Platform); and (ii) any Net Payment, unpaid trade credits or any other obligation owed by Client to any Coinbase Entity (in each case, whether matured or unmatured, fixed or contingent, or liquidated or unliquidated). Client agrees that in the exercise of setoff rights or secured party remedies, the Coinbase Entities may value Client Digital Assets using the same valuation methods and processes that are otherwise used when a Coinbase customer sells an asset on the Prime Platform or the applicable index or reference rate provided by Coindesk Indices, Inc. as determined by Coinbase in its sole discretion.

EXCEPT AS EXPRESSLY SET FORTH HEREIN TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE PRIME BROKER SERVICES AND THE COINBASE WEBSITE ARE PROVIDED ON AN “AS IS” AND “AS AVAILABLE” BASIS WITHOUT ANY WARRANTY OF ANY KIND, AND THE COINBASE ENTITIES HEREBY SPECIFICALLY DISCLAIM ALL WARRANTIES NOT SPECIFICALLY SET FORTH HEREIN WITH RESPECT TO THE PRIME BROKER SERVICES, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING THE IMPLIED WARRANTIES AND/OR CONDITIONS OF TITLE, MERCHANTABILITY, SATISFACTORY QUALITY, FITNESS FOR A PARTICULAR PURPOSE, AND/OR NON-INFRINGEMENT. EXCEPT AS EXPRESSLY SET FORTH HEREIN THE COINBASE ENTITIES DO NOT WARRANT THAT THE PRIME BROKER SERVICES, INCLUDING ACCESS TO AND USE OF THE COINBASE WEBSITES, OR ANY OF THE CONTENT CONTAINED THEREIN, WILL BE CONTINUOUS, UNINTERRUPTED, TIMELY, COMPATIBLE WITH ANY SOFTWARE, SYSTEM OR OTHER SERVICES, SECURE, COMPLETE, FREE OF HARMFUL CODE OR ERROR-FREE.

14

15

IN NO EVENT SHALL EITHER PARTY, ITS AFFILIATES AND SERVICE PROVIDERS, OR ANY OF THEIR RESPECTIVE OFFICERS, DIRECTORS, AGENTS, JOINT VENTURERS, EMPLOYEES OR REPRESENTATIVES, BE LIABLE FOR ANY LOST PROFITS OR ANY SPECIAL, INCIDENTAL, INDIRECT, INTANGIBLE, OR CONSEQUENTIAL DAMAGES, WHETHER BASED IN CONTRACT, TORT, NEGLIGENCE, STRICT LIABILITY, OR OTHERWISE, ARISING OUT OF OR IN CONNECTION WITH AUTHORIZED OR UNAUTHORIZED USE OF THE TRUST COMPANY SITE OR THE TRUST COMPANY CUSTODIAL SERVICES, OR THIS AGREEMENT, EVEN IF AN AUTHORIZED REPRESENTATIVE OF TRUST COMPANY HAS BEEN ADVISED OF OR KNEW OR SHOULD HAVE KNOWN OF THE POSSIBILITY OF SUCH DAMAGES.

IN NO EVENT SHALL ANY COINBASE ENTITY, ITS AFFILIATES, OR THEIR RESPECTIVE OFFICERS, DIRECTORS, AGENTS, EMPLOYEES AND REPRESENTATIVES HAVE ANY LIABILITY TO CLIENT OR ANY THIRD PARTY WITH RESPECT TO ANY BREACH OF ITS OBLIGATIONS HEREUNDER, EXPRESS, OR IMPLIED, WHICH DOES NOT RESULT FROM ITS NEGLIGENCE, FRAUD OR WILLFUL MISCONDUCT.

NOTHING IN THIS COINBASE PRIME BROKER AGREEMENT SHALL BE DEEMED TO CREATE ANY JOINT OR SEVERAL LIABILITY AMONG ANY OF THE COINBASE ENTITIES.

NOTWITHSTANDING ANYTHING HEREIN TO THE CONTRARY, THE COINBASE ENTITIES SHALL BE LIABLE TO CLIENT FOR THE LOSS OF ANY DIGITAL ASSETS ON DEPOSIT WITH THE COINBASE ENTITIES’ CUSTODIAL ACCOUNT(S) OR SETTLEMENT BALANCE(S) TO THE EXTENT THAT SUCH LOSS AROSE FROM THE COINBASE ENTITIES’ NEGLIGENCE, FRAUD, OR WILLFUL MISCONDUCT, AND THE COINBASE ENTITIES SHALL BE REQUIRED TO RETURN TO CLIENT A QUANTITY OF DIGITAL ASSETS EQUAL TO THE QUANTITY OF ANY SUCH LOST DIGITAL ASSETS.

16

EXCEPT FOR THE: (I) EXCLUDED LIABILITIES; (II) FRAUD; OR (III) WILLFUL MISCONDUCT SOLELY IN RESPECT OF CUSTODIAL SERVICES PROVIDED PURSUANT TO THE CUSTODY AGREEMENT, THE LIABILITY OF COINBASE CUSTODY SHALL NOT EXCEED THE GREATER OF: (I) THE AGGREGATE AMOUNT OF FEES PAID BY CLIENT TO COINBASE CUSTODY IN RESPECT OF THE CUSTODIAL SERVICES IN THE 12-MONTH PERIOD PRIOR TO THE EVENT GIVING RISE TO SUCH LIABILITY; OR (II) THE VALUE OF THE SUPPORTED DIGITAL ASSETS ON DEPOSIT IN CLIENT’S CUSTODIAL ACCOUNT(S) INVOLVED IN THE EVENT GIVING RISE TO SUCH LIABILITY AT THE TIME OF SUCH EVENT (THE VALUE OF WHICH SHALL BE CALCULATED AT THE AVERAGE UNITED STATES DOLLAR ASK PRICE, AT THE TIME OF SUCH EVENT, OF THE THREE (3) LARGEST U.S.-BASED EXCHANGES (BY TRAILING 30-DAY VOLUME) WHICH OFFER THE RELEVANT DIGITAL CURRENCY OR DIGITAL ASSET/USD TRADING PAIR, AS RELEVANT); PROVIDED, THAT IN NO EVENT SHALL COINBASE CUSTODY’S AGGREGATE LIABILITY IN RESPECT OF EACH COLD STORAGE ADDRESS EXCEED [***].

EXCEPT FOR THE: (I) EXCLUDED LIABILITIES; (II) FRAUD; OR (III) WILLFUL MISCONDUCT, IN NO EVENT SHALL THE AGGREGATE LIABILITY OF EITHER THE COINBASE ENTITIES OR CLIENT WITH RESPECT TO ANY BREACH OF ITS OBLIGATIONS HEREUNDER EXCEED THE GREATER OF: (A) THE VALUE OF THE CASH OR SUPPORTED DIGITAL ASSETS INVOLVED IN THE EVENT GIVING RISE TO SUCH LIABILITY AT THE TIME OF SUCH EVENT; (B) THE AGGREGATE AMOUNT OF FEES PAID BY CLIENT TO COINBASE IN RESPECT OF THE PRIME BROKER SERVICES IN THE 12-MONTH PERIOD PRIOR TO SUCH EVENT; OR (C) [***].

THE “EXCLUDED LIABILITIES” MEANS (X) WITH RESPECT TO CLIENT, (1) CLIENT’S DEFENSE AND INDEMNITY OBLIGATIONS UNDER THIS AGREEMENT, INCLUDING PURSUANT TO SECTION 19.1; (2) ANY OUTSTANDING COMMISSIONS OR FEES OWED BY CLIENT UNDER THIS AGREEMENT; (3) CLIENT’S BREACH OF SECTION 8.1 (PRIME BROKER SITE & CONTENT); AND (4) CLIENT’S BREACH OF SECTION 5 (REPRESENTATIONS AND WARRANTIES); AND (Y) WITH RESPECT TO THE COINBASE ENTITIES, ANY COINBASE ENTITIES’ DEFENSE AND INDEMNITY OBLIGATIONS UNDER THIS AGREEMENT, INCLUDING PURSUANT TO SECTION 19.2.

WITH RESPECT TO THE EXCLUDED LIABILITIES, COINBASE’S LIABILITY TO CLIENT FOR ANY LOSSES ARISING OUT OF OR IN CONNECTION WITH COINBASE’S DEFENSE AND INDEMNITY OBLIGATIONS UNDER THIS AGREEMENT WILL BE LIMITED, IN THE AGGREGATE, TO AN AMOUNT EQUAL TO [***].

The Coinbase Entities shall use and disclose Client’s and its Authorized Representatives’ non-public personal information in accordance with the Coinbase Privacy Policy, as set forth at https://www.coinbase.com/legal/privacy or a successor website, and as amended and updated from time to time.

22.1 The parties shall attempt in good faith to resolve any dispute arising out of or relating to this Coinbase Prime Broker Agreement promptly by negotiation. Any party may give the other party written notice of any dispute not resolved in the normal course of business. Within 15 days after delivery of the notice, the receiving party shall submit to the other a written response.

17

Within 30 days after delivery of the notice, the executives of both parties shall meet at a mutually acceptable time and place. Unless otherwise agreed in writing by the negotiating parties, the negotiation shall end at the close of the first meeting of executives described above (“First Meeting”). All offers, promises, conduct and statements, whether oral or written, made in the course of the negotiation by any of the parties, their agents, employees, experts and attorneys are confidential, privileged and inadmissible for any purpose, including impeachment, in any proceeding involving the parties, provided that evidence that is otherwise admissible or discoverable shall not be rendered inadmissible or non-discoverable as a result of its use in the negotiation.

22.2 At no time prior to the First Meeting shall either side initiate arbitration related to this Coinbase Prime Broker Agreement except to pursue a provisional remedy that is authorized by law or by agreement of the parties. However, this limitation is inapplicable to a party if the other party refuses to comply with the requirements of Section 22.1 above.

22.3 All applicable statutes of limitation and defenses based upon the passage of time shall be tolled while the procedures specified in Sections 22.1 and 22.2 above are pending and for 15 calendar days thereafter. The parties will take such action, if any, required to effectuate such tolling. The Party raising the issue will promptly notify the other in writing. Coinbase and Client will then meet in good faith to resolve the issue and, if they are unable to resolve the issue, will escalate the issue to their respective senior managers for resolution. Unless prohibited by applicable law or regulation, Coinbase shall not be relieved of its obligation to continue to perform under the Agreement while a dispute is ongoing.

22.4 If the matter is not resolved by negotiation pursuant to sections 22.1 through 22.3 above, any Claim arising out of or relating to this Coinbase Prime Broker Agreement, or the breach, termination, enforcement, interpretation or validity thereof, including any determination of the scope or applicability of the agreement to arbitrate as set forth in this Section 22, shall be determined by arbitration in the state of New York or another mutually agreeable location, before one neutral arbitrator. The arbitration shall be in accordance with the American Arbitration Association’s rules for arbitration of commercial related disputes (accessible at http://www.adr.org/sites/default/files/CommercialRules_Web-Final.pdf), and the award of the arbitrator (the “Award”) shall be accompanied by a reasoned opinion. Judgment on the Award may be entered in any court having jurisdiction. This Coinbase Prime Broker Agreement shall not preclude the Parties from seeking provisional relief, including injunctive relief, in any court of competent jurisdiction. Seeking any such provisional relief shall not be deemed to be a waiver of such party’s right to compel arbitration. The Parties expressly waive their right to a jury trial to the extent permitted by applicable law.

22.5 In any arbitration arising out of or related to this Coinbase Prime Broker Agreement, the arbitrator shall award to the prevailing party, if any, as determined by the arbitrator, all of its costs and fees. “Costs and fees” mean all reasonable pre-award expenses of the arbitration, including the arbitrator’s fees, administrative fees, travel expenses, out-of-pocket expenses such as copying and telephone, court costs, witness fees, and attorneys’ fees.

22.6 The Parties acknowledge that this Coinbase Prime Broker Agreement evidences a transaction involving interstate commerce. Notwithstanding the provision herein with respect to applicable substantive law, any arbitration conducted pursuant to the terms of this Coinbase Prime Broker Agreement shall be governed by the Federal Arbitration Act (9 U.S.C. §§ 1-16).

18

This Coinbase Prime Broker Agreement is effective as of the date written below and shall remain in effect until terminated by Coinbase or Client as follows:

“Cause” shall mean: (i) Client breaches any material provision of this Coinbase Prime Broker Agreement; (ii) Client takes any action to dissolve or liquidate, in whole or part; (iii) Client becomes insolvent, makes an assignment for the benefit of creditors, becomes subject to direct control of a trustee, receiver or similar authority; (iv) Client becomes subject to any bankruptcy or insolvency proceeding under any applicable laws, rules and regulations, such termination being effective immediately upon any declaration of bankruptcy; (v) Coinbase becomes aware of any facts or circumstances with respect to the Client’s financial, legal, regulatory or reputational position which may affect Client’s ability to comply with its obligations under this Coinbase Prime Broker Agreement; (vi) termination is required pursuant to a facially valid subpoena, court order or binding order of a government authority; (vii) Client’s Prime Broker Account is subject to any pending litigation, investigation or government proceeding and/or Coinbase reasonably perceives a heightened risk of legal regulatory non-compliance associated with Client’s use of Prime Broker Services; or (viii) Coinbase reasonably suspects Client of attempting to circumvent Coinbase’s controls or uses the Prime Broker Services in a manner Coinbase otherwise deems inappropriate or potentially harmful to itself or third parties.

“Coinbase Cause” shall mean: (i) any of the Coinbase Entities breaches any material provision of this Coinbase Prime Broker Agreement and such breach is not cured within three (3) business days; (ii) any of the Coinbase Entities takes any action to dissolve or liquidate, in whole or part; (iii) any of the Coinbase Entities becomes insolvent, makes an assignment for the benefit of creditors, becomes subject to direct control of a trustee, receiver or similar authority; (iv) any of the Coinbase Entities becomes subject to any bankruptcy or insolvency proceeding under any applicable laws, rules and regulations, such termination being effective immediately upon any declaration of bankruptcy and in the case of any involuntary proceeding, such proceeding is not dismissed or restrained within 30 days of its initiation; or (v) any applicable law, rule or regulation or any change therein or in the interpretation or administration thereof has or may have a material adverse effect on Client or the rights of Client or any Beneficiary with respect to any services covered by this Coinbase Prime Broker Agreement.

19

Additionally, in the event that Client forms the view, acting reasonably and based on material and objective facts and circumstances, that an event or cumulative effect of a series of events has occurred at Coinbase or a Coinbase Entity, that Client reasonably believes represents substantial risk to Client (whether reputationally or otherwise), Client’s senior executives shall escalate the matter to Coinbase’s senior executives and the Parties will promptly meet to discuss a resolution to the matter in good faith. Following such discussion, Coinbase shall have thirty (30) days to cure such event to the reasonable resolution of Client, provided such cure is possible. If Coinbase is unable to cure within this time period, or if Client reasonably holds the position that no practical solution exists to prevent material injury to its business (reputationally or otherwise) in light of such an adverse event, Client may provide written notice to Coinbase to remove the Majority Obligation requirements herein, upon written notice by Client to Coinbase, with the termination of the Majority Obligation becoming effective on the date provided in such notice. For the avoidance of doubt, changes that generally impact the digital assets markets at large shall not apply to the foregoing, except to the extent directly related to Coinbase.

If any provision or condition of this Coinbase Prime Broker Agreement shall be held invalid or unenforceable, under any rule, law, or regulation or any governmental agency (local, state, or federal), such provision will be changed and interpreted to accomplish the objectives of the provision to the greatest extent possible under any applicable law and the validity or enforceability of any other provision of this Coinbase Prime Broker Agreement shall not be affected and shall continue in full force and effect.

20

Any waivers of rights by a Party under this Coinbase Prime Broker Agreement must be in writing and signed by such Party. A waiver will apply only to the particular circumstance giving rise to the waiver and will not be considered a continuing waiver in other similar circumstances. A Party’s failure to insist on strict compliance with this Coinbase Prime Broker Agreement or any other course of conduct by the other Party shall not be considered a waiver of their rights under this Coinbase Prime Broker Agreement. Any waiver of rights that cannot be waived under applicable laws in the jurisdiction where the Client is located will not be recognized and be null and void.

All provisions of this Coinbase Prime Broker Agreement which by their nature extend beyond the expiration or termination of this Coinbase Prime Broker Agreement including, without limitation, sections pertaining to suspension or termination, Custodial Account cancellation, debts (including the Sponsor’s obligations under Sections 10 and 17) owed to the Coinbase Entities, general use of the Coinbase Prime Broker Site, disputes with Coinbase, and general provisions shall survive the termination or expiration of this Coinbase Prime Broker Agreement.

This Coinbase Prime Broker Agreement, Client’s Prime Broker Account, and the Prime Broker Services will be governed by and construed in accordance with the laws of the State of New York, excluding its conflicts of laws principles, except to the extent such state law is preempted by federal law.

The Coinbase Entities shall not be liable for delays, suspension of operations, whether temporary or permanent, failure in performance, or interruption of service which result directly or indirectly from any cause or condition beyond the reasonable control of the Coinbase Entities (a “Force Majeure Event”), including, but not limited to, any act of God; embargo; natural disaster; act of civil or military authorities; act of terrorists; government restrictions; any ruling by any Connected Trading Venue, exchange or market; market volatility or disruptions in order trading on any Connected Trading Venue, exchange or market; suspension of trading; civil disturbance; war; strike or other labor dispute; fire; severe weather; interruption in telecommunications, Internet services, or network provider services; network delays and congestion, a cybersecurity attack, hack or other intrusion by a third party of network provider or other third party, failure of equipment and/or software; failure of computer or other electronic or mechanical equipment or communication lines; outbreaks of infectious disease or any other public health crises, including quarantine or other employee restrictions; acts or omissions of any Connected Trading Venue; or any other catastrophe or other occurrence which is beyond the reasonable control of the Coinbase Entities and shall not affect the validity and enforceability of any remaining provisions. For the avoidance of doubt, a cybersecurity attack, hack or other intrusion by a third party or by someone associated with Coinbase against the Coinbase Entities is not a Force Majeure Event, to the extent due to Coinbase’s failure to comply with its obligations under this Agreement.

This Coinbase Prime Broker Agreement, together with all exhibits, addenda and supplements attached hereto or referenced herein, comprise the entire understanding between Client and the Coinbase Entities as to the Prime Broker Services and supersedes all prior discussions, agreements and understandings, including any previous version of this Coinbase Prime Broker Agreement, and the Custodial Services Agreement between Client and any Coinbase Entity, including all exhibits, addenda, policies, and supplements attached thereto or referenced therein. Section headings in this Coinbase Prime Broker Agreement are for convenience only and shall not govern the meaning or interpretation of any provision of this Coinbase Prime Broker Agreement.

21

Any modification or addition to this Coinbase Prime Broker Agreement must be in writing and either (a) signed by a duly authorized representative of each party, or (b) accepted and agreed to by Client. Client agrees that the Coinbase Entities shall not be liable to Client or any third party for any modification or termination of the Prime Broker Services, or suspension or termination of Client’s access to the Prime Broker Services, except to the extent otherwise expressly set forth herein.

Any assignment of Client’s rights and/or licenses granted under this Coinbase Prime Broker Agreement without obtaining the prior written consent, such consent shall not be unreasonably withheld, of Coinbase shall be null and void. Coinbase reserves the right to assign its rights under this Coinbase Prime Broker Agreement without restriction, including to any of the Coinbase Entities or their affiliates or subsidiaries, or to any successor in interest of any business associated with the Prime Broker Services, provided that Coinbase shall notify Client within a reasonable amount of time after such assignment. Any attempted transfer or assignment in violation hereof shall be void ab initio. Subject to the foregoing, this Coinbase Prime Broker Agreement will bind and inure to the benefit of the Parties, their successors and permitted assigns.

Client agrees and consents to receive electronically all communications, agreements, documents, notices and disclosures (collectively, “Communications”) that the Coinbase Entities provide in connection with Client’s Prime Broker Account and Client’s use of Prime Broker Services. Communications include: (a) terms of use and policies Client agrees to, including updates to policies or the Coinbase Prime Broker Agreement, (b) Prime Broker Account details, including transaction receipts, confirmations, records of deposits, withdrawals or transaction information, (c) legal, regulatory and tax disclosures or statements the Coinbase Entities may be required to make available to Client and (d) responses to claims or customer support inquiries filed in connection with Client’s Prime Broker Account.

Coinbase will provide these Communications to Client by posting them on the Prime Broker Site, emailing them to Client at the primary email address on file with Coinbase, communicating to Client via instant chat, and/or through other means of electronic communication. The Client agrees that electronically delivered Communications may be accepted and agreed to by Client through the Prime Broker Services interface. Furthermore, the Parties consent to the use of electronic signatures in connection with Client’s use of the Prime Broker Services.

If to Coinbase, to:

Legal Department

Coinbase Inc

248 3rd St, #434

Oakland, CA 94607

22

[***]

E-mail: [***]

If to Client, to

Grayscale Investments, LLC

290 Harbor Drive, 4^th Floor

Stamford, CT 06902

Attention: Michael Sonnenshein

E-mail: [***]

WITH A MANDATORY COPY OF ALL LEGAL NOTICES TO:

E-mail: [***]

If to Sponsor, to:

Grayscale Investments, LLC

290 Harbor Drive, 4^th Floor

Stamford, CT 06902

Attention: CEO of Grayscale Investments, LLC

E-mail: [***]

or such other address as such party may hereafter specify for the purpose by notice to the other parties hereto. Each of the foregoing addresses shall be effective unless and until notice of a new address is given by the applicable party to the other parties in writing. Notice will not be deemed to be given unless it has been received.

To Coinbase: [***].

To Client: the email address specified in its signature block on the Execution Page.

It is solely Client’s responsibility to provide Coinbase with a true, accurate and complete contact information including any e-mail address, and to keep such information up to date. Client understands and agrees that if Coinbase sends Client an electronic Communication, but Client does not receive it because Client’s primary email address on file is incorrect, out of date, blocked by Client’s service provider, or Client is otherwise unable to receive electronic Communications, Coinbase will be deemed to have provided the Communication to Client. Client may update Client’s information via Client’s Prime Broker Account and visiting settings or by providing a notice to Coinbase as prescribed above.

This Coinbase Prime Broker Agreement may be executed in one or more counterparts, including by email of .pdf signatures or DocuSign (or similar electronic signature software), each of which shall be deemed to be an original document, but all such separate counterparts shall constitute only one and the same Coinbase Prime Broker Agreement.

23

36. Inspection and Auditing.

(i) Inspection and Auditing of Coinbase. To the extent Coinbase may legally do so, it shall permit Client or Client’s third party representatives under obligations to secure Coinbase’s information no less restrictive than this Coinbase Prime Broker Agreement upon thirty (30) days’ advance written notice, to inspect, take extracts from and audit the records maintained in relation to the Client, and take such steps as necessary to verify that satisfactory internal control systems and procedures are in place, as Client may reasonably request.

Client shall reimburse Coinbase (A) for all reasonable expenses incurred in connection with this Section 36, and (B) for reasonable time spent by Coinbase’s employees or consultant in connection with this Section 36 at reasonable hourly rates to be agreed upon by Client and Coinbase. Any such audit will be conducted during normal business hours and in a manner designed to cause minimal disruption to Coinbase’s ordinary business activities. The scope of any such audit will be jointly agreed to by Client and Coinbase in advance of any audit, provided that neither party shall be unreasonable with respect to the scope of such audit, and shall not include items other than those relevant to the Prime Services Coinbase provides to Client. Nothing in this section shall be interpreted to require Coinbase to disclose trade secrets, information related to other clients, provide access to secure facilities or services (such as “Vault” locations), or otherwise impair the security or availability of services Coinbase offers to other clients, provided that Coinbase will use reasonable efforts to provide Client with such information or substantially equivalent information in a manner that does not violate the foregoing.

(ii) Trust Company Audit Reports. Coinbase shall, as soon as reasonably practicable after receipt of any audit report prepared by its internal or independent auditors pursuant to Coinbase’s annual audit or otherwise, provide Client notification if such audit report reveals any material deficiencies or makes any material objections, furnish to Client a report stating the nature of such deficiencies or such objections, and describing the steps taken or to be taken to remedy the same. Such audit report will be deemed Confidential Information of Coinbase.

[Signatures on following page]

24

IN WITNESS WHEREOF, the Parties have caused this Coinbase Prime Broker Agreement, including the Coinbase Custodial Services Agreement, and Coinbase Settlement and Transfer Agreement, to be duly executed and delivered as of the date below.

25

EXHIBIT A

to the Coinbase Prime Broker Agreement

COINBASE CUSTODY CUSTODIAL SERVICES AGREEMENT

This Custody Agreement is entered into between Client and Coinbase Custody and forms a part of the Coinbase Prime Broker Agreement between the Client and the Coinbase Entities. Capitalized terms used in this Custody Agreement that are not defined herein shall have the meanings assigned to them in the other parts of the Coinbase Prime Broker Agreement.

1. CUSTODIAL SERVICES.

Client hereby appoints Trust Company as its majority (“majority” meaning here at least [***] of Client’s total Digital Asset holdings are held with Trust Company, subject to the provisions set forth herein)¹ provider of Custodial Services (the “Majority Obligation”). Trust Company shall establish Client’s “Custodial Account” as a segregated custody account controlled and secured by Trust Company to store certain supported digital currencies and utility tokens (“Digital Assets”), on Client’s behalf (the “Custodial Services”). Trust Company is a fiduciary under § 100 of the New York Banking Law and a qualified custodian for purposes of Rule 206(4)-2(d)(6) under the Investment Advisers Act of 1940, as amended, and is licensed to custody Client’s Digital Assets in trust on Client’s behalf. Digital Assets in Client’s Custodial Account are not treated as general assets of Trust Company. Rather, Trust Company serves as a fiduciary and custodian on Client’s behalf, and the Digital Assets in Client’s Custodial Account are considered fiduciary assets that remain Client’s property at all times. In addition, Coinbase Custody shall maintain: (i) any registrations, permits, licenses, approvals and consents issued by any governmental or quasi-governmental authority or regulatory organization necessary for it to carry out any of its obligations hereunder; and (ii) any adequate capital and reserves to the extent required by applicable law and shall not, directly or indirectly, lend, pledge, hypothecate or re-hypothecate or otherwise encumber any Digital Assets in the Custodial Account.

The Parties agree that if at any time the Client does not meet the Majority Obligation then the Parties will have a period of ninety (90) days to discuss this Section 1, and if applicable negotiate an amendment. If after ninety (90) days (i) the Parties have not reached an agreement, and (ii) the Majority Obligation is not met by Client then the other provisions of this Coinbase Prime Broker Agreement will apply (including Sections 22 and 23 the of General Terms).

2. CUSTODIAL ACCOUNT.

2.1. In General. The Custodial Services: (i) allow holding the Vault Balance in Client’s Custodial Account and transfer Digital Assets among the Vault Balance and the Settlement Balance (as defined in Exhibit B, STA); (ii) allow supported Digital Assets to be deposited from a public blockchain address to Client’s Custodial Account; and (iii) allow Client to withdraw supported Digital Assets from Client’s Custodial Account to a public blockchain address Client controls pursuant to instructions Client provides through the Trust Company Site (each such transaction is a “Custody Transaction”). Client shall only withdraw or deposit Digital Assets to public blockchain addresses or to Client’s Settlement Balance. The Digital Assets stored in Client’s Custodial Account are not commingled with Digital Assets that Trust Company custodies for its other clients or Digital Assets of Trust Company and are custodied pursuant to the terms of this Custody Agreement and any addenda thereto. Trust Company reserves the right to

26

refuse to process or to cancel any pending Custody Transaction as required by law or in response to a subpoena, court order, or other binding government order or to enforce transaction, threshold, and condition limits, in each case as communicated to Client as soon as reasonably practicable where Trust Company is permitted to do so, or if Trust Company reasonably believes that the Custody Transaction may violate or facilitate the violation of an applicable law, regulation or applicable rule of a governmental authority or self-regulatory organization. Trust Company cannot reverse a Custody Transaction which has been broadcast to a Digital Asset network.

2.2 Digital Asset Deposits and Withdrawals. Trust Company processes supported Digital Asset deposits and withdrawals according to the Instructions received from Authorized Representatives, and Trust Company does not guarantee the identity of any Authorized Representative. Client should verify all transaction information prior to submitting Instructions to Trust Company. Client should manage and keep secure any and all information or devices associated with deposit and withdrawal verification procedures, including YubiKeys and passphrases or other security or confirmation information. Trust Company reserves the right to charge network fees (miner fees) to process a Digital Asset transaction on Client’s behalf. Trust Company will calculate the network fee, if any, in its discretion, although Trust Company will always notify Client of the network fee at or before the time Client authorizes the transaction. Trust Company reserves the right to delay any Custody Transaction if it perceives a risk of fraud or illegal activity.

2.3 Processing of Custody Transactions; Availability of Custodial Account and Custodial Services.

(i) Absent a Force Majeure Event as defined in Section 28 (Force Majeure) of the Coinbase Prime Broker Agreement, from the time Trust Company has verified the authorization of a complete set of Instructions to withdraw Digital Assets from Client’s Custodial Account, Trust Company will have [***] hours, unless the Parties otherwise agree in writing to an alternate time frame, to process and complete such Instruction to withdraw Digital Assets from Client’s Custodial Account and send those Digital Assets to the applicable Digital Asset network or to Client’s Settlement Balance (“Transfer Time”), provided however; that in each case in the event that Trust Company is unable to process a withdrawal within the Transfer Time, the Trust Company shall have an additional [***] hours following the expiration of the Transfer Time to complete the withdrawal request (“Cure Period”); and

(ii) Notwithstanding the foregoing, in the event of a Force Majeure Event as defined in Section 28 (Force Majeure) of the Coinbase Prime Broker Agreement and for so long as the Force Majeure Event is continuing, the timing requirements of Section 2.3(A)(i) shall not apply. Once the Force Majeure Event ceases to exist as determined by Trust Company in its good faith and reasonable discretion, then Trust Company shall process and complete such verified Instruction to withdraw in [***] hours, unless the Parties otherwise agree in writing to an alternate time frame, which in each case remains subject to the Cure Period provisions as described above.

Trust Company makes no other representations or warranties with respect to the availability and/or accessibility of the Digital Assets or the availability and/or accessibility of the Custodial Account or Custodial Services.

27

2.4. Safekeeping of Digital Assets. Trust Company shall use commercially reasonable efforts to keep in safe custody on behalf of Client all Digital Assets received by Trust Company. All Digital Assets credited to the Custodial Account shall:

(i) be held in the Custodial Account at all times, and the Custodial Account shall be controlled by Trust Company;

(ii) be labeled or otherwise appropriately identified as being held for Client;

(iii) be held in the Custodial Account on a non-fungible basis;

(iv) not be commingled with other Digital Assets held by Trust Company, whether held for Trust Company’s own account or the account of other clients other than Client;

(v) not without the prior written consent of Client be deposited or held with any third-party depositary, custodian, clearance system or wallet;

(vi) for any Custodial Accounts maintained by Trust Company on behalf of Client, Trust Company will use commercially reasonable efforts to keep the private key or keys secure, and will not disclose such keys to Client or to any other individual or entity except to the extent that any keys are disclosed consistent with a standard of commercially reasonable effort and as part of a multiple signature solution that would not result in the Grayscale Investment Product or Sponsor “storing, holding, or maintaining custody or control of” the Digital Assets “on behalf of others” within the meaning of the New York BitLicense Rule (23 NYCRR Part 200) as in effect as of June 24, 2015 such that it would require the Grayscale Investment Product or Sponsor to become licensed under such law.

2.5 Supported Digital Asset. The Custodial Services are available only in connection with those Digital Assets that Trust Company, in its sole discretion, decides to support. The Digital Assets that Trust Company supports may change from time to time. Prior to initiating a deposit of Digital Asset to Trust Company, Client must confirm that Trust Company offers Custodial Services for that specific Digital Asset. By initiating a deposit of Digital Asset to a Custodial Account, Client attests that Client has confirmed that the Digital Asset being transferred is a supported Digital Asset offered by Trust Company. Under no circumstances should Client attempt to use the Custodial Services to deposit or store Digital Assets in any forms that are not supported by Trust Company. Depositing or attempting to deposit Digital Assets that are not supported by Trust Company will result in such Digital Asset being unretrievable by Client and Trust Company. Trust Company assumes no obligation or liability whatsoever regarding any unsupported Digital Asset sent or attempted to be sent to it, or regarding any attempt to use the Custodial Services for Digital Assets that Trust Company does not support. To confirm which Digital Assets are supported by Trust Company, Client should login at https://custody.coinbase.com and carefully review the list of supported Digital Assets. Trust Company recommends that Client deposit a small amount of supported Digital Asset as a test prior to initiating a deposit of a significant amount of supported Digital Asset. Trust Company may from time to time determine types of Digital Asset that will be supported or cease to be supported by the Custodial Services. Trust Company shall provide Client with thirty (30) days’ written notice before ceasing to support a Digital Asset, unless Trust Company is required to cease such support by court order, statute, law, rule (including a self-regulatory organization rule), regulation, code, or other similar requirement, in which case written notice shall be provided as soon as reasonably practicable.

2.6. Use of the Custodial Services. Client acknowledges and agrees that Trust Company may monitor use of the Custodial Account and the Custodial Services and the resulting information may only be utilized, reviewed, retained and or disclosed by Trust Company as is necessary for its internal purposes or in accordance with the rules of any applicable legal, regulatory or self-regulatory organization or as otherwise may be required to comply with relevant law, sanctions programs, legal process or government request.

28

2.7. Independent Verification. If Client is subject to Rule 206(4)-2 under the Investment Advisers Act of 1940, Trust Company shall, upon written request, provide Client authorized independent public accountant confirmation of or access to information sufficient to confirm (i) Client’s Digital Assets as of the date of an examination conducted pursuant to Rule 206(4)-2(a)(4), and (ii) Client’s Digital Assets are held either in a separate account under Client’s name or in accounts under Client’s name as agent or trustee for Client’s clients.

2.8. Third-Party Payments. The Custodial Services are not intended to facilitate third-party payments of any kind. As such, Trust Company has no control over, or liability for, the delivery, quality, safety, legality or any other aspect of any goods or services that Client may purchase or sell to or from a third party (including other users of Custodial Services) involving Digital Assets that Client intends to store, or have stored, in Client’s Custodial Account.

2.9. Termination, and Cancellation. If Trust Company closes Client’s Custodial Account or terminates Client’s use of the Custodial Services, Client will be permitted to withdraw Digital Assets associated with Client’s Custodial Account for a period of up to ninety (90) days following the date of deactivation or cancellation to the extent not prohibited: (i) under applicable law, including applicable sanctions programs; or (ii) by a facially valid subpoena, court order, or binding order of a government authority.

2.10. Location of Digital Assets. The Location of the Digital Assets shall be the United States. Trust Company shall acquire written approval of Client prior to changing the Location of the Digital Assets outside of the United States, except in the event of a security or disaster recovery event necessitating immediate remediation, in which case Trust Company will provide notice to Client as soon as reasonably practicable. “Location” means, with respect to any Digital Assets, the jurisdiction in which Trust Company deems such Digital Assets to be present.

2.11. Third-Party or Non-Permissioned Use. Except for fund administrators, Client shall not grant permission to a third party or non-permissioned user to access or connect to Client’s Custodial Account, either through the third party’s product or service or through the Trust Company Site. Client acknowledges that granting permission to a third party or non-permissioned user to take specific actions on Client’s behalf does not relieve Client of any of Client’s responsibilities under this Custody Agreement and may violate the terms of this Custody Agreement. Client is fully responsible for all acts or omissions of any third party or non-permissioned user with access to Client’s Custodial Account, other than Trust Company. Further, Client acknowledges and agrees that Client will not hold Trust Company responsible for, and will indemnify Trust Company from, any liability arising out of or related to any act or omission of any third party or non-permissioned user with access to Client’s Custodial Account, except to the extent of Trust Company’s fraud, negligence, or willful misconduct. Client must notify Trust Company immediately after becoming aware of a third party or non-permissioned user accessing or connecting to Client’s Custodial Account by contacting Client’s Custodial Account representative or by emailing [***] from the email address associated with Client’s Custodial Account.

2.12 Relationship of the Parties. Nothing in this Custody Agreement shall be deemed or is intended to be deemed, nor shall it cause, Client and Trust Company to be treated as partners, joint ventures, or otherwise as joint associates for profit, or either Client or Trust Company to be treated as the agent of the other.

3. TRUST COMPANY OBLIGATIONS.

3.1. Bookkeeping. Trust Company will keep timely and accurate records as to the deposit, disbursement, investment, and reinvestment of the Digital Assets. Trust Company will maintain accurate records and bookkeeping of the Custodial Services as required by applicable law and in accordance with Trust Company’s internal document retention policies, but in no event for less than seven years.

29

3.2. Insurance. Trust Company will obtain and maintain, at its sole expense, insurance coverage in such types and amounts as are commercially reasonable for the Custodial Services provided hereunder.

4. COINBASE REPRESENTATIONS

5. ADDITIONAL MATTERS

In addition to any additional service providers that may be described in an addendum or attachment hereto, Client acknowledges and agrees that the Custodial Services may be provided from time to time by, through or with the assistance of affiliates of or vendors to Trust Company. Client shall receive notice of any material change in the entities that provide the Custodial Services.

[Remainder of page intentionally left blank]

30

EXHIBIT B

to the Coinbase Prime Broker Agreement

COINBASE SETTLEMENT AND TRANSFER AGREEMENT

Client should carefully consider holding Digital Assets is suitable for its purpose, including in relation to Client’s knowledge of Digital Assets and Digital Asset markets and Client’s financial condition. All investments involve risk, and the past performance of a financial product does not guarantee future results or returns.

This Settlement and Transfer Agreement (“STA”) sets forth the terms and conditions for clients to transfer Digital Assets through the execution infrastructure of the Prime Broker Services platform (“Prime Platform” or “Settlement Platform”) and forms a part of the Coinbase Prime Broker Agreement between Client and the Coinbase Entities. Pursuant to this STA, Coinbase shall open a Settlement Account for the Client on the Prime Platform consisting of linked accounts at Coinbase and Coinbase Custody, each accessible via the Prime Platform (“Settlement Account”). This Settlement Account is on the Prime Platform however Client acknowledges and agrees that the Settlement Account will not be used for trading. Capitalized terms used in this STA that are not defined herein shall have the meanings assigned to them in the other parts of the Coinbase Prime Broker Agreement.

If Coinbase is holding Client Assets in the Settlement Balance, has no record of Client’s use of the Prime Services for an extended period, and is otherwise unable to contact Client, Coinbase may be required under applicable laws, rules or regulations to report these assets as unclaimed property and to deliver such unclaimed property to the applicable authority. Coinbase may deduct a dormancy fee or other administrative charge from such unclaimed funds, as permitted by applicable laws, rules or regulations.

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK]

Appendix 1

to the Coinbase Prime Broker Agreement

COINBASE PRIME FEE SCHEDULE

[***]

COINBASE SECURITY ADDENDUM

This Security Addendum is incorporated into and made a part of that certain Coinbase Prime Broker Agreement (the “Agreement”) between Coinbase, Inc. (“CB Inc.”) and Coinbase Custody Trust Company, LLC (“CB Custody”) (for purposes of this Security Addendum, CB Inc. and CB Custody are collectively referred to herein as, “Coinbase”) and the Client set forth in the Agreement (herein the “Customer”).

1. Introduction

Purpose. Coinbase is committed to maintaining customer trust. The purpose of this Security Addendum is to describe the security program for the Coinbase services as more fully described in the Agreement (the “Services”). This Security Addendum describes the minimum security standards that Coinbase maintains in order to protect its customers’ data from unauthorized use, access, disclosure, theft, or manipulation. As security threats shift and evolve, Coinbase continues to update its security program and strategy to help protect its customers’ data. Coinbase reserves the right to update this Security Addendum from time to time; provided, however, any update will not materially reduce the overall protections set forth in this Security Addendum.

Services Covered. This Security Addendum describes the organizational, administrative, technical, and physical controls, as well as third party security audit certifications that are applicable to the Custodial and/or Institutional Services more fully described in the Agreement.

2. Security Governance

Security Program. Coinbase’s information security program is centrally managed by its Global Security & Privacy departments, which is responsible for managing security across all global locations, all Coinbase products and services, and engagement of Coinbase sub processors. The framework for Coinbase’s information security program includes operational, administrative, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of sensitive data, including customer data, and is aligned to the NIST Cybersecurity Framework. Coinbase employs numerous defense-in-depth strategies to secure information assets, utilizing industry guidelines from NIST. Coinbase’s Chief Security Officer (CSO) meets on a regular basis with executive management and the Board of Directors to discuss security risks, issues, and company-wide security initiatives. Internal information security policies and standards are reviewed, assessed, and updated on at least an annual basis, and are made available to all Coinbase employees.

Security Policy Governance. Coinbase has controls in place to maintain the confidentiality of customer data in accordance with the Agreement. All Coinbase employees and contract personnel are bound by Coinbase’s internal policies regarding maintaining confidentiality of customer data.

Security Compliance. Coinbase has obtained System and Organization Controls (SOC) certifications where applicable and is periodically evaluating other areas for additional certifications. The certification reports are shared upon request with our customers and prospects (subject to appropriate and binding contractual confidentiality provisions).

3. Third Party Security

Vendor Agreements. Coinbase secures agreements with its third-party service providers that impose obligations of confidentiality and/or security practices and commitments, as appropriate and applicable.

Vendor Assessments. Coinbase may use affiliates and third-party vendors to provide the Services. Coinbase carries out a risk-based assessment of prospective vendors before working with those vendors to validate that prospective vendors meet Coinbase’s security requirements. Coinbase periodically reviews each vendor in light of Coinbase’s security and business continuity standards, including the type of access and classification of data being accessed (if any), controls necessary to protect data, and legal/regulatory requirements. Coinbase ensures that customer data is returned and/or deleted at the end of a vendor relationship.

4. People Operations

Employee On-Boarding. Coinbase carries out background checks on individuals joining Coinbase in accordance with applicable local laws. Coinbase currently verifies the individual’s education and previous employment. Where local labor law or statutory regulations permit, Coinbase conducts criminal and, in certain instances, credit background checks on its employees, contractors, and consulting agencies.

5. Data Security

Data Lifecycle Security. At any point during or after the term of a customer’s agreement(s) with Coinbase, and upon a customer’s reasonable, written request, Coinbase will delete customer data. Coinbase will ensure such data is deleted in accordance with Coinbase’s data records retention policy. Coinbase may retain backup records of customer data (i) as required by law (or its own data retention policy, as applicable), and (ii) in secured form. Paper assets are shredded to P-7/Level 6 security standards. Hardware and associated data assets are destroyed in accordance with the NIST SP 800-88, Guidelines for Media Sanitization. After wiping and degaussing, sanitized hardware awaiting shredding and certificate of disposal is locked in a depot dedicated to Coinbase cold-storage.

Data Encryption. Client data and transaction records are encrypted both at rest and in transit. Coinbase has implemented mature data encryption protocols and standards to ensure that its encryption is supported by a defined key management process that is reviewed against current best practices. All data is encrypted in transit, including all traffic to and from Coinbase servers.

Data Backups. Coinbase performs regular backups of Coinbase account information, call records, call recordings and other critical data using third-party cloud storage solutions. Backup data are retained redundantly across availability zones and are encrypted in transit and at rest.

6. Identity and Access Management

Logical Access Provisioning and De-provisioning. To minimize the risk of data exposure, Coinbase follows the principles of least privilege through a team-based access-control model when provisioning system access. Coinbase personnel are authorized to access customer data based on their job function, role and responsibilities, and such access requires approval of the employee’s manager. Access rights to production environments are reviewed according to a risk-based approach. An employee’s access to customer data is promptly removed upon termination of their employment. In order to access the production environment, an authorized user must have a unique username and password, multi-factor authentication and be connected to Coinbase’s Virtual Private Network (VPN). Before an engineer is granted access to the production environment, access must be approved by management and the engineer is required to complete internal trainings for such access including trainings on the relevant team’s systems. Coinbase logs high risk actions and changes in the production environment. Coinbase leverages automation to identify any deviation from internal technical standards that could indicate anomalous/unauthorized activity to raise an alert within minutes of a configuration change. Coinbase personnel who leave the company, no longer work with Coinbase, or change business roles have their access privileges revoked or modified within a predetermined timeframe.

Authentication Mechanisms. Coinbase enforces authentication requirements across all Coinbase systems, including password requirements (e.g. password length, complexity, history, limitations on retries, and use of a password manager) and multi-factor authentication (MFA) requirements. All credentials are encrypted in transit, and hashed at rest. Coinbase strives to ensure that authentication requirements and implementations meet or exceed current best practices for authentication, based on the current threat landscape.

Remote Access. Remote access to the Coinbase network by authorized personnel is encrypted and requires multifactor authentication (MFA) for remote access, including X509 certificate and username/password login credentials. For production infrastructure access, use of VPN is also enforced. Coinbase’s network follows zero trust principles; any non-Coinbase devices that may access the network have no privileged access and must rely on strong identity controls to access Coinbase resources. Coinbase office networks are treated as untrusted by default. While WPA-PSK encryption is required to access office Wi-Fi, devices on this network are not automatically granted access to corporate or production systems. Users that wish to have corporate email on their mobile devices must enroll in Coinbase’s mobile device management (MDM) solution. Rooted devices are not permitted. Company-owned computers are managed and kept up-to-date with the latest operating system, antivirus, and productivity software updates. All hard drives are encrypted. Upon return and prior to reissuance of an authorized laptop, the laptop must be completely wiped.

7. Physical & Environmental Security

Physical Site Security. AWS data centers that host the Services are strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors. All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. These facilities are designed to withstand adverse weather and other reasonably predictable natural conditions. Each data center has redundant electrical power systems that are available twenty-four (24) hours a day, seven (7) days a week. Uninterruptible power supplies and on-site generators are available to provide back-up power in the event of an electrical failure. More details about the physical security of AWS data centers used by Coinbase for the Services, are available at https://aws.amazon.com/whitepapers/overview-of-security-processes/. In addition, Coinbase office spaces have a physical security program that manages visitors, building entrances, CCTVs (closed circuit television), and overall office security. Physical security audits are performed annually.

8. Corporate Security

Security Awareness Training. All personnel must complete the Coinbase security and privacy training, which covers Coinbase security policies, security best practices, and privacy principles. All personnel must refresh their training at least annually. Coinbase’s security and privacy teams regularly communicate emerging data privacy requirements and security threats and trends to personnel. Personnel have multiple avenues for reporting incidents or suspicious activity, including notifying the Global Security & Privacy Team, in person, over the telephone, text, email as well as through a Slack channel dedicated to reporting such incidents. Personnel can also reach the Coinbase Global Security Operations Center 24/7.

9. DevOps Security

Change Management. Coinbase has built a production environment designed with strict controls, which includes a formal change management process to manage changes to software, applications and system software that will be deployed within the production environment. New (or changes made to existing) products, services and features (“Changes”) are deployed in a development environment that closely mirrors the production environment. Before Changes are deployed in the production environment, they are peer reviewed and automated security, functional, and unit testing is performed. Customer data is not used outside of the production environment unless required for troubleshooting issues where real data is relevant and, even then, the data is first obfuscated to prevent exposure of personal data. Prior to high-risk Changes being made, an assessment is carried out to consider the impact and risk of a requested change, evidence acknowledging applicable testing for the change, approval of deployment into production by appropriate approver(s), and roll back procedures. After all tests are passed, and peer reviews completed, Changes are deployed to the production environment. All Changes deployed in the production environment must be indexed and documented using a formal and auditable system of record. The production environment is closely monitored for anomalous conditions that may suggest unexpected activity or potential security threats. When a vulnerability is identified, the criticality will be evaluated and the service affected will be isolated, patched or upgraded as necessary according to vulnerability management requirements. Coinbase has implemented a Bug Bounty Program, available at https://hackerone.com/coinbase, through which researchers may report design and implementation issues or possible vulnerabilities.

10. Cryptography, Encryption & Key Management

Key Storage. Coinbase maintains private keys on behalf of its customers either on secure servers or in offline (or “cold”) storage whereby Coinbase encrypts and shards the wallet key materials then stores and manages them in secure, geographically distributed locations.

11. Cloud & Network Security

Secure Infrastructure. Coinbase uses and leverages AWS data centers in order to provide the Services. AWS has a reputation of being highly scalable, secure, and reliable. Information about AWS audit certifications are available at AWS Security website https://aws.amazon.com/security and AWS Compliance website https://aws.amazon.com/compliance. Coinbase reviews AWS SOC reports on a regular basis.

12. Systems Monitoring & Logging

Logging. Coinbase’s production environment network activity is monitored and centrally logged. All logs are maintained in an instantly-queryable state for at least ninety (90) days before being moved to archival storage in accordance with Coinbase’s data retention policy. All logs are stored in such a manner as to assure that a stored record is immutable and non-tamperable, or where the log storage facility cannot provide such guarantees, a durable audit record of any attempts to modify or tamper with data. Security-relevant logs must be retained for a retention period of seven (7) years. Any given 24-hour period retained in archival storage must be queryable within a reasonable amount of time (e.g. within a business day) for the duration of the retention period.

Security Monitoring. Intrusion detection rules are configured to alert on suspicious activity in production services. The Coinbase Security Operations team is responsible for all security monitoring. All production systems are instrumented with appropriate detection and response tooling relative to the nature of the system and fed into a centralized SIEM. The on-call Security Operations analyst who receives any alerts is responsible for ensuring appropriate resolution of the event, or else properly escalating the alert according to Coinbase’s security incident response plan.

13. Threat & Vulnerability Management

Vulnerability Scanning. Coinbase employs security best practices to ensure that the Services are secured, updates to its primary services do not introduce new vulnerabilities, and that new services have been sufficiently analyzed for and defended from potential vulnerabilities. Coinbase supplements its day-to-day security practices, including architecture reviews, with regular vulnerability assessments and audits, including (1) automated scans of all code and applications where possible to identify vulnerabilities before ever being introduced to Coinbase’s environment; (2) once services are deployed, implementing continuous monitoring to promptly assess and react to any potential vulnerabilities; and (3) regular evaluation by independent third parties. Critical software patches are evaluated, tested and applied proactively.

Penetration Testing. Coinbase performs penetration tests and engages independent third-party entities to conduct application-level penetration tests on an annual basis at minimum. Results of penetration tests are prioritized, triaged, and remediated promptly by Coinbase’s security team according to established SLAs.

14. Security Incident Management

Incident Communication. Coinbase will promptly investigate all security incidents and to the extent that is permitted by applicable law, promptly notify its customers of a security incident that impacts its customer data.

15. Business Continuity & Disaster Recovery

Business Continuity Planning. Business continuity is included as part of Coinbase’s security policy. The Coinbase’s production network has been designed to be recoverable and/or replaceable and runs on multiple servers in AWS with load balancing and failover provisions. Instances can be spun up as needed if one fails. Data is backed up to alternate data centers. Data centers are located in geographically diverse locations to ensure redundancy in the case of a catastrophic event.