Coinbase said on October 28, 2026 that a security incident at Amplitude, a third-party analytics provider, exposed a small subset of its customer contact data. According to CoinDesk, the exchange says customer funds are safe. Coinbase also stresses that the Coinbase Amplitude episode is not a breach of its own systems. The company has not said how many customers are affected, which contact fields leaked, or when the incident happened.
That gap between a firm denial and a thin disclosure drives most of the questions readers are searching for today. This analysis separates what Coinbase has confirmed from what remains open, explains why contact data still matters to crypto users, and looks at what the Amplitude incident says about vendor risk across the industry.
The timing is awkward for the sector. Exchanges in several markets have disclosed data problems in recent weeks, and our earlier report on the Bithumb and Daishin breach that hit 38,490 customers showed how quickly customer lists become a scam toolkit. Coinbase sits in the same threat model, even though its statement draws a clear line between a vendor incident and a direct compromise.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Coinbase Amplitude Incident: What Happened
Coinbase identified the source of the problem as Amplitude, a third-party analytics provider. Product teams use analytics vendors like this to measure how people use an app or website, which means the vendor holds some customer-linked records on the company’s behalf. When the vendor has a security incident, those records can leave the company’s control even if its own servers stay untouched.
Coinbase said the incident affected a small subset of Coinbase customer contact data, along with data from other Amplitude customers. That second detail matters. It tells readers the exposure was not aimed at Coinbase alone, and that other companies using the same analytics service may face their own notifications. Coinbase has not named those other customers, and the reporting reviewed for this article does not either.
The company framed its response in three parts. It said it found no evidence of unauthorized access to Coinbase systems. It said customer funds were not impacted. And it said it is notifying affected customers by email and notifying regulatory agencies in line with its legal obligations. Yahoo Finance carried the same framing under a headline noting that funds were not impacted.
What Coinbase Has Confirmed So Far
The confirmed list is short, and every item comes from Coinbase’s own statement as relayed by the outlets named in this article. Nothing below depends on anonymous sources or social-media rumor.
- Coinbase says it has not had a data breach.
- The incident occurred at Amplitude, a third-party analytics provider.
- A small subset of Coinbase customer contact data was affected, alongside data from other Amplitude customers.
- Coinbase found no evidence of unauthorized access to its systems.
- Customer funds were not impacted.
- Affected customers are being notified by email, and regulators are being notified under Coinbase’s legal obligations.
Read carefully, these statements are narrow by design. “Not a breach” refers to Coinbase’s own infrastructure. “Contact data” describes a category, not a field list. And “small subset” is a relative term that Coinbase has not translated into a number. None of that makes the statements false. It does mean customers should treat them as a starting point rather than a full accounting.
What Coinbase Has Not Disclosed
The list of unknowns is longer than the list of confirmations. Cryptopolitan reported that the Amplitude incident exposed contact data of some Coinbase users, and none of the coverage reviewed fills in the missing specifics. The table below tracks each open item against its current status.
| Question | Current status | Basis |
|---|---|---|
| Was Coinbase’s own system breached? | Denied by Coinbase | Coinbase statement, no evidence of unauthorized access |
| Were customer funds affected? | Not impacted, per Coinbase | Coinbase statement |
| How many customers were affected? | Unconfirmed | No count disclosed |
| Which contact fields were exposed? | Unconfirmed | No complete list provided |
| When did the Amplitude incident occur? | Unconfirmed | No date in cited reports |
| Did more than 70,000 users lose data? | Unconfirmed | Claim not confirmed by Coinbase |
| Are regulators notified? | Yes, per Coinbase | Coinbase says it is notifying agencies |
The field list is the most practical gap. An email address supports one kind of attack, while a phone number, full name, or postal address supports others. Until Coinbase publishes the fields, customers cannot judge which scams to expect, so the safest posture is to assume any contact channel tied to a Coinbase account could be targeted.
Coinbase’s Own Words: The Verified Statements
Coinbase Support posted the company’s position on its official account at x.com/CoinbaseSupport. These four statements are quoted verbatim from that source, and they form the backbone of the public record so far.
On the central denial, Coinbase Support, the official Coinbase support account, wrote: “Coinbase has not had a data breach.”
On the vendor angle, the same account described the event this way: “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
On the scope of harm, Coinbase Support stated: “We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.”
And on the legal response, the account said: “We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.”
Notice what the four statements leave out. There is no timeline, no count, no field list, and no description of how the vendor was compromised. Those omissions are common in a first-day disclosure. They also explain why secondary claims, including the 70,000 figure covered next, spread so fast.
The 70,000-User Claim: Why It Stays Unconfirmed
An unaffiliated social-media account claimed that data on more than 70,000 users had been obtained. Coinbase has not confirmed that figure, and the reporting that mentioned it also pointed out that it sits awkwardly beside the company’s “small subset” wording. Treat the number as a rumor until Coinbase or a regulator publishes a count.
There are good reasons for caution. Figures that circulate in the first hours of an incident often come from screenshots, partial samples, or unrelated datasets. They can also mix records from several Amplitude customers, which would inflate any single company’s apparent exposure. A count that large could be accurate, exaggerated, or a blend of victims. Nothing in the available record lets a reporter tell which.
The practical takeaway for readers is simple. Do not repeat the 70,000 number as fact, and do not assume a lower number either. Watch for the notification email, because Coinbase says it is contacting affected customers directly, and judge your own risk from that message rather than from headlines.
Why Third-Party Analytics Vendors Are a Weak Link
Analytics and customer-data vendors collect behavior and identity records from many clients at once. That concentration makes them attractive targets. One compromise at the vendor can produce records from dozens of companies, which is why Coinbase’s own wording stresses that other Amplitude customers were affected too.
The shared-vendor problem
A company can run a hardened network, require hardware keys for staff, and still lose customer contact data through a supplier. The security perimeter now includes every vendor that stores or processes customer records. Regulators increasingly expect firms to account for that, which helps explain why Coinbase says it is notifying agencies.
What data minimization changes
The strongest defense is sending the vendor less. If an analytics tool receives hashed or pseudonymous identifiers instead of raw emails and phone numbers, a vendor incident exposes far less usable information. Whether Coinbase did that for the affected records is unknown, and the company has not said. Security teams can still audit their own setups. Our walkthrough on auditing HTTPS traffic with mitmproxy shows how to see exactly which fields an app sends to third parties.
Why Contact Data Still Matters for Crypto Users
Coinbase says funds were not impacted, and nothing in the reviewed coverage suggests passwords, private keys, or authentication credentials were part of the exposure. Reports characterized the potentially exposed information as contact data. That is genuinely better than a credential leak. It is not harmless.
Email addresses and phone numbers let attackers build convincing phishing, impersonation, and social-engineering campaigns. A scammer who knows you hold a Coinbase account can pose as support, claim a withdrawal needs review, and push you toward a fake login page. The attack works without touching Coinbase’s systems, because it targets the customer instead.
Crypto users face a sharper version of this risk than bank customers do. Transfers are fast and usually irreversible, so one misplaced click can drain a wallet before anyone notices. That is why a leak that sounds minor on paper still deserves a response. A strong authenticator setup also blunts many of these attacks, and our ranking of the best authenticator apps for 2026 covers the options.
What Coinbase Customers Should Do Now
Guidance in the coverage points the same direction. Treat unsolicited messages claiming to be from Coinbase as suspicious, avoid clicking links in them, never share authentication codes, and reach Coinbase through channels you enter yourself. These steps cost nothing and apply whether or not you receive a notification.
- Do not click links in any email, text, or direct message that mentions Coinbase. Open the app or type the address yourself.
- Never read out or type a verification code for someone who contacted you first. Genuine support does not need it.
- Check that your account uses an authenticator app or hardware key instead of SMS codes where possible.
- Confirm your withdrawal allowlist and security settings inside the official app.
- Look for the Coinbase notification email, and verify it by logging in directly rather than following its links.
- Check your address against breach-monitoring tools, which our guide to setting up Have I Been Pwned alerts walks through.
Any caller who says they are from Coinbase and urges you to move funds to a “safe wallet” is running a scam. Hang up and contact the company through the official app. That advice would hold on any ordinary day, but exposed contact details raise the odds that such a call reaches a real customer.
How This Compares With Other Recent Incidents
Gadgets360 grouped the Coinbase disclosure with data leaks reported by Bithumb and other South Korean financial firms, a sign that customer-data exposure has become a recurring theme for crypto and finance companies this month. The incidents differ in cause, so side-by-side comparison needs care. The table below uses figures from our own earlier reporting on this site.
| Incident | Key figure | Type of exposure | Our coverage |
|---|---|---|---|
| Coinbase and Amplitude | Count not disclosed | Vendor-held customer contact data | This article |
| Bithumb, Daishin, Mirae Asset | 38,490 customers | Customer data breach at Korean firms | Breach analysis |
| Capcom ID | 11.77 million accounts | Breach with 196 password resets | Capcom analysis |
| Navigate360 and P3 Global Intel | 8 million crime tips | Hack that ran 7 months | Navigate360 report |
| TiDB Cloud | 28 days | Stolen service account | TiDB breach |
The pattern is easier to see in a table. Coinbase is the only case here where the headline number is missing, and the only one that rests on a vendor, which is why its disclosure leaves more room for speculation than the others. Larger numbers do not always mean larger harm. A small list of well-targeted contact records can fuel a scam campaign as effectively as millions of stale ones.
Historical Context: Vendor Exposure Versus Direct Breach
Security teams have long separated incidents into two buckets. In a direct breach, attackers get into the company’s own systems. In a vendor exposure, the data leaves through a supplier’s environment. The legal duties, the forensic work, and the public messaging differ between the two, and companies tend to lean on that distinction when they communicate.
Coinbase’s wording follows that playbook closely: no breach, no unauthorized access to its systems, no impact on funds. The framing is accurate if the facts hold, and customers should still care about the exposure. A user whose phone number lands in a scammer’s list does not experience the incident differently because it started at a vendor.
This article does not recap Coinbase’s earlier security incidents or other analytics-vendor cases, because the research behind it could not verify those details from fresh primary sources. Readers who want that history should check the company’s own disclosures and regulators’ filings. For a recent look at what happens when a supplier-side key or account is stolen, our report on the Rank Math PRO backdoor and UpdraftCentral key theft shows how supply-chain compromises spread downstream.
Market and Regulatory Impact
The verified record contains no figures on any market reaction, and this article will not guess at one. What is on the record is the regulatory step. Coinbase says it is notifying regulatory agencies in accordance with its legal obligations, which signals the company views the event as reportable even while denying a direct breach.
Several consequences are plausible but unconfirmed. Regulators may ask for the affected-customer count and a timeline. Other Amplitude clients may issue their own notices. And exchange customers may press for clearer disclosure standards around vendors. None of these has been announced. They are the logical next questions given what Coinbase has said, and readers should treat them as open rather than expected.
For the wider cybersecurity picture, our cybersecurity coverage hub tracks breaches, ransomware, and vendor-risk stories as they develop.
Lessons for Security Teams Running Analytics Tools
Any company that ships a mobile app or web product probably sends customer-linked events to a third party. The Coinbase case gives teams a reason to check what that traffic contains. A short review can answer most of the important questions.
- List every analytics, support, and marketing vendor that receives customer records.
- Inspect the actual payloads. Do they carry raw emails, phone numbers, or names, or hashed identifiers?
- Set retention limits so vendors do not hold contact data indefinitely.
- Write vendor-incident clauses that require fast notice and a clear scope statement.
- Prepare a customer message in advance that names the vendor, the data category, and a phishing warning.
The last item is the one Coinbase had to execute under pressure. Customers judge a company on how clearly it explains a vendor incident, and a statement that names the data category and warns about phishing earns more trust than one that only says funds are safe.
Five Predictions for the Coinbase Amplitude Fallout
These are analyst-style judgments from this publication, not reported facts, and none comes from a named expert.
- Coinbase will face pressure to publish a count. Silence on the number feeds the 70,000 rumor, and regulators tend to ask for figures.
- More Amplitude customers will come forward. Coinbase said other clients were affected, so further notices from other firms are likely.
- Phishing aimed at Coinbase users will rise. Contact-data exposure reliably brings impersonation campaigns within days.
- Vendor-data minimization will become a talking point. Expect security teams to review what they send to analytics providers.
- The field list will decide the story’s weight. If phone numbers or names are included, the risk profile changes more than any count would.
Frequently Asked Questions
Did Coinbase suffer a data breach?
Coinbase says no. The company states that it has not had a data breach and found no evidence of unauthorized access to its systems. The incident occurred at Amplitude, its third-party analytics provider.
Are my funds at risk after the Amplitude incident?
Coinbase says customer funds were not impacted. The risk that remains is indirect, since exposed contact details can help scammers trick people into moving money themselves.
How many Coinbase customers were affected?
Coinbase has not disclosed a count. It describes a small subset of customer contact data. A claim of more than 70,000 users circulated on social media, but Coinbase did not confirm it.
What information was exposed?
Coinbase calls it customer contact data and has not provided a complete list of fields. Reports describe contact information rather than passwords, private keys, or wallet-fund data.
When did the Amplitude incident happen?
No date has been disclosed in the cited reports. Coinbase also has not explained how the vendor was compromised.
How will I know if I was affected?
Coinbase says it is notifying affected customers by email. Verify any such email by logging in to the official app directly instead of clicking its links.
What should I do about phishing messages?
Treat unsolicited messages that claim to come from Coinbase as suspicious. Do not click their links, never share authentication codes, and contact Coinbase through channels you open yourself.
Were other companies affected by the Amplitude incident?
Coinbase said the incident also touched data from other Amplitude customers. The reporting reviewed here does not name them.
