Coinbase Amplitude Breach Exposes Customer Contact Data, Exchange Says Funds Safe

The Coinbase Amplitude breach came to light on Tuesday, October 28, 2026, when the exchange's support account posted on X that a security incident at analytics vendor Amplitude had exposed contact data belonging to a small subset of Coinbase customers. The post opened with a denial: Coinbase itself had not suffered a data breach.

The disclosure matters because it shows how customer data can leak through third-party vendors even when an exchange's core systems stay intact. Coinbase said no one gained unauthorized access to its own systems and customer funds were left untouched, but it declined to say how many users were affected or which contact details were exposed.

What Coinbase said about the Coinbase Amplitude breach

In the post dated October 28, the Coinbase Support account wrote that Amplitude, an analytics vendor the exchange works with, had experienced a security incident that impacted a small subset of Coinbase customer contact data, along with data belonging to other Amplitude customers. The company stressed that the incident originated at the vendor, not within the exchange itself.

According to the exchange, its own infrastructure showed no signs of intrusion and customer funds were not impacted. A Coinbase spokesperson, writing to Unchained by email on Wednesday, confirmed that contact and limited transaction data were affected, but not home addresses or any other information that would allow someone to directly access an account or its funds.

Coinbase said it is notifying affected customers directly by email and reporting the incident to regulators in line with its legal obligations. Users who want to know whether they fall in the affected group will need to wait for that notification, since the company has not published a way to check.

The company left key questions unanswered. It gave no count of affected customers, did not list which types of contact data were exposed, did not say when the incident at Amplitude occurred, and did not name the other Amplitude clients whose data was touched. Coinbase also offered no guidance on any specific protective steps for customers whose contact data was exposed.

Disputed 70,000 figure circulates before confirmation

Hours before Coinbase published its statement, claims about the scale of the Coinbase Amplitude breach were already spreading on X. An account called DelCrxpto posted around 8 p.m. ET on October 27 asserting that a Coinbase breach was confirmed and that hackers held contact information for more than 70,000 users, without citing a source, according to Unchained.

Roughly 30 minutes before Coinbase posted, 23pds, who describes himself on X as chief information security officer at blockchain security firm SlowMist, repeated the assertion that hackers had contact details for more than 70,000 users, Cryptopolitan reported. Unchained said it did not find any report from SlowMist itself backing the figure.

The Coinbase spokesperson called the 70,000 figure false and said they believed it originated with Grok, the AI chatbot on X, which mixed up the new incident with Coinbase's May 2025 case, Unchained reported. A spokesperson for venture firm Archetype separately told CryptoPotato that the number stems from the earlier incident, not the current one. Unchained said it could not independently confirm how the figure began.

Amplitude stays silent as questions remain

Amplitude has not issued a public statement explaining how the breach occurred. No statement about the incident appeared on the company's blog at the time of publication, and it did not immediately respond to a request for comment from Unchained, the outlet reported.

CoinDesk connected the disclosure to supply chain risk, noting that customers can face security threats through third parties even when a company's core infrastructure remains secure. CoinDesk said it reached out to Coinbase for comment on the matter.

Even when passwords, private keys and funds are untouched, leaked email addresses and phone numbers can still feed phishing and social-engineering campaigns, CryptoNews reported. That risk makes even limited contact data from an analytics vendor worth taking seriously.

Vendor breaches keep hitting crypto firms

The Coinbase Amplitude breach is the latest in a string of incidents in which crypto companies saw customer data exposed through outside partners. Trezor, the hardware wallet maker, disclosed in September that its shipping provider ShipMonk had been breached, compromising the names, phone numbers and home addresses of 67,000 U.S. customers, adding to nearly 14,000 already disclosed in August. Some of those records went back to 2019, years after ShipMonk had assured Trezor the data had been deleted.

Trezor urged those affected to stay alert for fraudulent emails, phone calls and physical mail, and cautioned that the leak could threaten their physical safety. Cybercrime consultant David Sehyeon Baek said at the time that receiving a letter bearing a person's name and home address tells them the sender knows where to find them, and noted that such stolen information remains valuable for years because people seldom relocate or switch phone numbers.

In August 2026, hardware wallet maker SafePal said an access control vulnerability had exposed order data for around 39,798 customers, Cryptopolitan reported. SafePal warned that criminals could exploit the stolen information to impersonate support staff over the phone, dangle fake refunds, push phony software update prompts and steer victims toward lookalike phishing websites.

The same week brought fresh incidents elsewhere. South Korea's second-largest crypto exchange, Bithumb, reportedly suffered a data leak after an unauthorized outsider accessed one of its internal workplace tools, with some customer personal data reportedly leaked on October 28, according to Yonhap News Agency. Daishin Securities reported that information belonging to more than 38,000 customers was leaked, and Mirae Asset Global Investments said it spotted unauthorized access on some of its web systems, though it maintained only internal business data was exposed.

Coinbase's 2025 breach looms over the response

The rapid denial of a wider breach reflects Coinbase's history. In May 2025, the exchange revealed that criminals had paid off overseas support staff to hand over personal information belonging to under 1% of its monthly transacting users. The attackers demanded a $20 million ransom, which Coinbase refused to pay, instead offering a $20 million bounty for information leading to the attackers' arrest.

A subsequent filing submitted to Maine's attorney general stated that 69,461 customers were affected in that case, with exposed data including names, addresses, masked Social Security numbers and government ID images. Coinbase estimated remediation costs and customer reimbursements at $180 million to $400 million, and said the criminals planned to use the customer list to impersonate the exchange and trick people into sending crypto.

Tuesday's post did not tie the Amplitude incident to that earlier case, and the exchange's framing of the Coinbase Amplitude breach as a vendor-side problem with no system intrusion draws a clear line between the two events.

Conclusion

Coinbase maintains that the Coinbase Amplitude breach exposed contact and limited transaction data for only a small subset of customers, that its own systems saw no unauthorized access, and that customer funds were not impacted. The exchange has rejected the circulating claim that more than 70,000 users were affected, attributing the figure to confusion with its May 2025 incident.

The next concrete step is notification: Coinbase says it is emailing affected customers directly and informing regulators as required by law. Until those notices arrive, the number of affected users, the specific data fields involved and the timing of the incident at Amplitude remain undisclosed, and Amplitude has yet to comment publicly.

Frequently Asked Questions

Was Coinbase itself hacked in the Amplitude incident?

Coinbase says no. The exchange stated it found no evidence of unauthorized access to its own systems and that customer funds were not impacted. It described the event as a security incident at Amplitude, a third-party analytics vendor, that exposed contact data for a small subset of Coinbase customers along with other Amplitude clients.

How many Coinbase customers were affected by the Amplitude breach?

Coinbase has not disclosed a number, saying only that a small subset of customers was affected. A claim circulating on X that hackers obtained contact details for more than 70,000 users was called false by a Coinbase spokesperson, who said the figure likely came from confusion with the exchange's separate May 2025 incident.

What customer data was exposed in the Coinbase Amplitude breach?

Coinbase said contact and limited transaction data were impacted, but not home addresses or any other information that would allow someone to directly access an account or its funds. The company has not specified which particular contact fields, such as email addresses or phone numbers, were exposed.

Were customer funds stolen in the Coinbase Amplitude breach?

Coinbase said customer funds were not impacted and that there is no evidence of unauthorized access to its systems. A company spokesperson said the exposed data did not include anything that would allow someone to directly access an account or its funds.

How will Coinbase customers know if their data was exposed?

Coinbase said it is notifying impacted customers directly by email and reporting the incident to regulators in line with its legal obligations. Users who want to know whether they are in the affected group will need to wait for that notification, as the exchange has not provided a way to check independently.