Coinbase says vendor Amplitude exposed customer contact data, denies breach

What happened

Coinbase has traced the exposure of some customer contact information to a security incident at Amplitude, a third-party analytics provider, while maintaining that its own platform was not compromised. In a post on X on the evening of Oct. 27, U.S. time, the exchange's support account said Coinbase had not suffered a data breach and that the problem originated on the vendor's side.

According to the statement, the Amplitude incident affected a small subset of Coinbase customer contact data, as well as information belonging to other Amplitude clients. Coinbase said it had found no evidence that anyone gained unauthorized access to its systems and that customer funds were not affected.

The statement came after claims had circulated on X for nearly three hours. Around 8 p.m. ET on Oct. 27, an account posting as DelCrxpto said, without citing a source, that a Coinbase breach had been confirmed and that hackers had obtained contact details for more than 70,000 users. Roughly two hours later, 23pds, who describes himself as a partner and chief information security officer at blockchain security firm SlowMist, repeated the claims while quoting that post. Unchained, which reviewed the posts, said it found no report from SlowMist itself, and Coinbase did not address the 70,000 figure.

The exchange did not say how many customers were affected, which contact fields were exposed, or when the Amplitude incident occurred, and it did not name the other Amplitude clients involved. Coinbase said it is notifying affected customers and regulatory agencies in line with its legal obligations. Amplitude had not published a statement on its blog at the time of reporting, and neither company immediately responded to a request for comment from Unchained; Cointelegraph said it had not received a reply by publication.

Why it matters

Leaked contact details such as email addresses and phone numbers are a common starting point for phishing, so even a limited exposure can leave customers facing convincing fraudulent messages. Coinbase has not said whether people whose data was involved should take any specific steps, leaving users to watch for suspicious outreach on their own.

The disclosure also highlights how much customer data sits with outside service providers. An incident at an analytics vendor can touch several companies at once, and Coinbase's account indicates that other Amplitude clients were affected alongside its own users.

It landed in a busy stretch for security incidents. Wallet maker Foundation traced phishing emails to a backend breach, Keystone said an intruder took customer names and addresses from its website, South Korea's Bithumb is investigating whether a breach of an internal work platform exposed customer information, and brokerage Daishin Securities reported a leak involving 38,490 customers.

What the data shows

Several figures have circulated around the incident, but only some are confirmed. The 70,000-plus user figure came from an anonymous X post and was repeated by a security executive; Coinbase did not confirm or dispute it. By contrast, the 69,461 notification count and the $180 million to $400 million cost range relate to the separate 2025 breach and come from Coinbase's own disclosures and a state regulatory filing. The 38,490 figure refers to Daishin Securities, an unrelated case.

Background

Coinbase has handled exposed customer data before. In May 2025 it disclosed that criminals had bribed overseas support staff to pass along user information, that it would not pay a $20 million extortion demand, and that it estimated remediation costs and customer reimbursements at $180 million to $400 million. A filing with Maine's attorney general said 69,461 users would be notified, and Cointelegraph reported the earlier breach affected less than 1% of monthly transacting users. The Oct. 27 post did not connect the Amplitude incident to that earlier case.

What is still unclear

Key details remain unanswered: the number of Coinbase customers affected, the specific contact fields involved, the date of the Amplitude incident, and the identity of the other Amplitude clients whose data was touched. It is also not known which regulators received notifications or whether Amplitude plans its own disclosure.

What to watch

Attention now turns to whether Amplitude publishes an incident notice and how broadly its clients were affected. Also worth watching is whether Coinbase provides a customer count or guidance on phishing precautions, and whether regulators in the jurisdictions where it operates comment on the notifications.

Questions readers ask