Coinbase Denies Breach as Amplitude Incident Hits Customer Contact Data
Coinbase says it has not had a data breach, but a security incident at analytics vendor Amplitude exposed contact data for a small subset of customers. Coinbase has not confirmed a victim count; a SlowMist CISO claims more than 70,000 users. Phishing is the main risk.
Coinbase says it has "not had a data breach." A security incident at third-party analytics vendor Amplitude still exposed contact data for a "small subset" of its customers. Coinbase Support made the statement on X on October 28, 2026.
"Coinbase has not had a data breach."
Coinbase Support (@CoinbaseSupport)
The post says Amplitude "experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers." Coinbase said it found no evidence of unauthorized access to its own systems. Customer funds were not impacted.
Coinbase is notifying affected customers and regulatory agencies under its legal obligations. It did not say how many customers were affected, which contact data types were exposed, when the incident happened, or which other Amplitude customers were hit.
The 70,000 claim
A number is circulating anyway. The claim surfaced on October 28 after SlowMist CISO 23pds (@im23pds) posted that hackers had accessed contact information for more than 70,000 users. Coinbase has not confirmed any figure.
Phishing is the risk
No funds hit does not mean no risk. Exposed contact details can feed targeted phishing and social engineering. Treat unsolicited security messages with suspicion. Never share passwords or 2FA codes. Use official channels only.
The exposure is not unique to exchanges, either. Banks suffer similar vendor breaches, which makes this less a verdict on centralized platforms than on third-party data handling.
Context
Coinbase has been here before. In May 2025 it disclosed that cybercriminals bribed overseas support agents to steal data on under 1% of monthly transacting users. It refused a $20 million ransom and offered a $20 million bounty instead. A later Maine attorney general filing put affected customers at 69,461, with names, addresses, masked Social Security numbers and government ID images exposed. Coinbase estimated potential reimbursement and remediation costs of up to $400 million.
That case involved bribed insiders. This one involves a vendor. The distinction matters for the "no breach" framing, not for a user whose contact details are now in someone else's hands.
Vendor-side leaks keep landing on crypto firms. Trezor disclosed a September breach via ShipMonk that exposed data of 67,000 US customers, on top of nearly 14,000 disclosed in August.
Outsourcing is already a sore spot for Coinbase with regulators. The Central Bank of Ireland recently fined Coinbase Ireland €3.25 million over safeguarding failures, including poorly overseen outsourcing to its US parent.
Two questions stay open: how many customers, and which data fields. Coinbase has answered neither.
