Coinbase reported that a security breach at Amplitude, a third-party analytics service, led to the exposure of contact data for a limited number of its customers. The cryptocurrency exchange stated that no unauthorized access to Coinbase’s own systems occurred and reaffirmed that customer funds remain unaffected.
Amplitude breach impacts Coinbase users
Coinbase issued a statement on X late Tuesday explaining that the incident was linked to its analytics vendor Amplitude, not the exchange’s own infrastructure. The company stressed that it is notifying affected customers and regulatory authorities as required by legal guidelines. However, Coinbase has not specified how many users are impacted and has not listed which data fields were exposed.
Amplitude is a behavioral analytics platform that helps companies track and analyze user engagement with web and mobile applications. Several firms reportedly experienced fallout from this breach.
Roughly thirty minutes before Coinbase’s statement, 23pds, chief information security officer of blockchain security firm SlowMist, claimed that the breach exposed contact details for over 70,000 Coinbase users. Coinbase has not confirmed the figure and instead described the affected group as a “small subset.”
No details have emerged regarding whether sensitive account credentials or customer funds were compromised in the breach. Both Coinbase and SlowMist have yet to confirm if passwords or wallet funds were among the leaked information.
Coinbase wrote in its public post, “Coinbase has not had a data breach. This is a security incident at Amplitude that impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
The exchange reassured users that it found no evidence of attackers accessing its systems or moving customer assets.
Mini dictionary: Amplitude is a data analytics company that provides tools for organizations to measure product usage and user behavior to optimize their digital platforms. It is widely used for event tracking and customer analytics.
Risks of exposed contact data
While the exposed data did not include passwords or private keys, contact details open up the possibility of phishing campaigns. Scammers often use leaked names, phone numbers, or emails to carry out social engineering attacks targeting crypto users.
Similar incidents have affected other parts of the crypto industry. In August 2026, hardware wallet manufacturer SafePal experienced an access control vulnerability that revealed order data for close to 40,000 customers. SafePal cautioned that these details could be exploited for fraudulent support calls, fake refund offers, phishing site links, and requests for software updates.
Coinbase customers have been targeted in the past. In May 2025, the company discovered that certain overseas support agents had been bribed by criminals to provide customer data for phishing schemes. Coinbase responded by designating up to $400 million in compensation and recovery measures, including a $20 million reward for information that could facilitate arrests.
Blockchain investigator ZachXBT estimated in February 2025 that crypto scams against Coinbase users resulted in losses exceeding $65 million in just two months, with annual damages reaching $300 million.
| Incident | Company | Data Exposed | Estimated Users Affected | Date |
|---|---|---|---|---|
| Analytics vendor breach | Coinbase (via Amplitude) | Contact details | Over 70,000 (unconfirmed) | Oct 2026 |
| Vulnerability in CRM | SafePal | Order data | 39,798 | Aug 2026 |
| Insider bribe | Coinbase | Personal data | Subset of users | May 2025 |
According to exchange statements, affected customers are being notified directly, and Coinbase has emphasized that the incident remains limited in scope, with no evidence of direct financial loss or asset compromise.
The chief information security officer of SlowMist, 23pds, also expressed concern earlier in 2026 about Coinbase Commerce’s request that customers enter recovery phrases on an official page, calling it a poor security practice.
Security experts continue to advise users never to disclose recovery phrases or personal keys, as these are critical to account safety and asset protection.
