Coinbase Links Customer Data Exposure to Amplitude
Coinbase says a security incident at analytics provider Amplitude exposed contact information connected to a small subset of its customers. The exchange says its own systems were not accessed without authorization and that customer funds remain safe.
The disclosure has drawn attention because contact details can be used in phishing and social-engineering campaigns, even where attackers have not gained access to customer accounts or exchange infrastructure.
What happened
Coinbase said the incident originated at Amplitude, a third-party analytics provider, rather than within Coinbase’s own systems, CoinDesk reported on Wednesday. The exchange rejected descriptions of the event as a Coinbase hack and said it found no evidence of unauthorized access to its systems.
According to Decrypt, the Amplitude incident affected a “small subset” of Coinbase customers. Coinbase did not state how many customers were affected.
The data involved was limited contact information, according to CoinDesk. Yahoo Finance similarly reported that Coinbase said some customer contact data was affected alongside information belonging to other Amplitude clients.
Coinbase has said customer funds were not affected. CoinDesk reported that the company said its systems had not been accessed without authorization, while Yahoo Finance reported that Coinbase denied attackers had breached its own systems.
The company is notifying affected customers and regulatory agencies, according to Yahoo Finance. Crypto.news reported that Coinbase said affected customers would receive notifications by email and that regulatory notifications would be made in line with legal obligations.
Reports circulating on X on October 27 alleged that contact information for more than 70,000 users had been obtained. That figure remains unconfirmed. Yahoo Finance reported that Coinbase had not confirmed claims involving more than 70,000 users, and Coinbase did not provide an official count.
Why it matters
The incident illustrates the security exposure that can arise through service providers used by large crypto platforms. Coinbase says the relevant security event occurred at Amplitude, but the affected information included Coinbase customer contact details.
Email addresses and phone numbers can be a common starting point for phishing. An attacker who has those details may attempt to impersonate an exchange, support representative or other trusted service in an effort to obtain credentials, verification codes or other sensitive information.
CoinDesk reported that affected customers could face phishing and social-engineering attempts using exposed email addresses or phone numbers. The available reports do not establish that Coinbase accounts were accessed or that customer assets were compromised.
That distinction is central to Coinbase’s response. The company has denied that it had a data breach, saying instead that Amplitude experienced a security incident affecting a small subset of customer contact data. Coinbase has also maintained that customer funds remain safe.
For customers, the disclosure separates two related but different risks: an exposure of contact information and an intrusion into exchange systems. The reports cited by Coinbase concern the former, while the company says it has found no evidence of the latter.
Background and context
Contact-data exposure has been a significant issue for Coinbase before. In May 2025, Coinbase disclosed that criminals had bribed overseas support staff to pass along user information. The company said at the time that it would not pay a $20 million extortion demand.
Coinbase estimated that remediation and reimbursements tied to that earlier episode could cost between $180 million and $400 million. It also said 69,461 users would need to be notified.
The Amplitude-related event differs from that earlier disclosure in Coinbase’s description of its origin. In the current case, the exchange says the event began at an outside analytics vendor and says there is no evidence of unauthorized access to Coinbase systems.
The absence of a disclosed customer count also leaves the scale of the current exposure unresolved. Decrypt reported only Coinbase’s description of a small subset, while reports claiming more than 70,000 affected users have not been confirmed by the company.
What to watch
Further disclosures could clarify how many Coinbase customers were affected, which categories of contact information were exposed and when Amplitude discovered the security incident.
It will also be important to watch for additional information from Coinbase or relevant regulators about the customer-notification process. Coinbase has said it is notifying affected customers and regulatory agencies, but the reports do not specify the number of notifications or the jurisdictions involved.
Another open question is whether the company provides further detail on the claimed figure of more than 70,000 affected users. Coinbase has not confirmed that number, and the available reports do not establish it.
Finally, any subsequent reports of phishing activity connected to the exposure would help show how the disclosed contact information may be used. For now, Coinbase’s stated position is that its systems were not accessed without authorization and that customer funds remain unaffected.
