Coinbase Blames Amplitude for Customer Contact Data Exposure

By Coinvote

Published October 28, 2026 - 11:22 UTC | 4 mins read

Coinbase says a security incident at analytics vendor Amplitude exposed contact data for a small subset of its customers, while its own systems and customer funds were not affected. The company has not said how many people are involved or which data fields were exposed.

Coinbase points to its analytics vendor, not its own systems

According to Decrypt, contact details for a limited group of Coinbase customers were exposed in an incident involving its outside analytics provider, Amplitude. The statement came from the Coinbase Support account on X. According to Decrypt and Cointelegraph, the exchange also said its investigation turned up no sign that anyone had gained access to its internal systems.

Customer funds were not affected, Coinbase said. The Defiant reported that the exchange is notifying impacted users and regulators. CoinDesk added that customers are being informed by email, as the law requires. The statement also made clear that other Amplitude clients were hit by the same incident.

The details Coinbase has not yet disclosed

Decrypt noted that Coinbase gave no customer count, no description of the types of contact data involved and no date for the incident. The exchange also did not name the other Amplitude customers involved.

Cointelegraph asked Coinbase for a customer count and had received no reply by publication. CoinDesk said it had also approached the company for comment. The Defiant's report was available only as a headline and summary, so it adds nothing beyond the denial of a systems breach, the unaffected funds and the notifications.

Where the four outlets agree and where they differ

All four outlets give the same core account. A vendor had an incident, a limited group of customers had contact data exposed, Coinbase saw no sign of intrusion into its own systems, and funds were untouched. The differences are small but real.

Decrypt described the statement as posted on Tuesday night. Cointelegraph said the exchange made the disclosure on Wednesday. None of the outlets explains the gap, although the post embedded by Decrypt carries an October 28 date.

CoinDesk framed the story as a rebuttal of reports of a hack. It was also the only outlet to spell out why contact details matter. In its view, exposed email addresses and phone numbers can be useful raw material for phishing and social engineering even when passwords, private keys and funds are not compromised.

Why a vendor leak still carries risk for customers

CoinDesk said the episode underlines supply-chain risk. A company's core infrastructure can stay secure while its customers are still exposed through the outside services it relies on. Analytics providers typically hold behavioural and account data on behalf of many clients, so one incident can reach several firms at once, as Coinbase's reference to other Amplitude customers suggests.

Decrypt placed the case beside a recent precedent. Last month, according to Decrypt, hardware wallet maker Trezor disclosed that a breach at its shipping provider ShipMonk had exposed the personal details of 67,000 customers in the United States, including their names, phone numbers and home addresses. Part of that data went back to 2019, even though ShipMonk had earlier told Trezor it had been erased. Cybercrime consultant David Sehyeon Baek told Decrypt that a letter bearing a name and address signals "we can locate you."

The numbers behind the coverage

Coinbase's new incident: a "small subset" of customers, with no count given.
May 2025 breach at Coinbase: less than 1% of monthly transacting users affected, according to both Decrypt and Cointelegraph.
Decrypt reported that a subsequent notice filed with the Maine attorney general counted 69,461 affected customers in that case.
Coinbase refused a $20 million ransom demand in 2025 and offered a $20 million bounty instead, Decrypt reported.
Cointelegraph said the exchange estimated reimbursement and remediation costs for the 2025 breach at up to $400 million.
Trezor's ShipMonk breach: 67,000 U.S. customers, on top of nearly 14,000 disclosed in August.

South Korean disclosures landed the same day

Cointelegraph and CoinDesk both tied the Coinbase news to a wave of data-security reports from South Korea. Cointelegraph said Bithumb is examining whether customer information was exposed through an intrusion into its internal work platform. It also reported that the brokerage Daishin Securities disclosed a leak affecting 38,490 customers, covering both personal and credit details.

CoinDesk's account is slightly different. It said Daishin detected signs of unauthorized access last week and that the exposed data included names, email addresses and mobile phone numbers. For Bithumb, CoinDesk cited Yonhap News Agency in reporting that some customer information was leaked in an attack by an external party. It also said financial authorities have begun an inspection into a data breach at Mirae Asset Global Investments. None of the outlets links these cases to Amplitude.

Open questions to watch

The first question is scale. Coinbase has not said how many customers were affected, and the figure for its 2025 incident only became public through a state attorney general filing, as Decrypt noted. Whether a similar filing appears this time is unknown.

The second is scope. The data fields exposed, the date of the incident and the identity of the other Amplitude customers remain undisclosed, and Amplitude's own account was not part of the reports. Readers who receive a notice from Coinbase should expect those details to matter most for judging phishing risk.

FAQ

Was Coinbase hacked in the Amplitude incident?

Coinbase says no. The exchange said the incident happened at Amplitude, its analytics vendor, and that its own systems showed no sign of intrusion. Customer funds were not affected, according to Decrypt, Cointelegraph, CoinDesk and The Defiant.

What customer data was exposed at Coinbase?

Coinbase said the exposure involved contact information for a small group of its customers. CoinDesk noted that the exchange gave neither a customer count nor a list of the fields involved.

Why does exposed contact data matter if funds are safe?

CoinDesk said email addresses and phone numbers can still be used for phishing and social-engineering attacks. Decrypt's Trezor example showed that stolen contact details can stay useful for years.