Coinbase Says Amplitude Vendor Incident Exposed Customer Contact Data
In this article
Coinbase said on Wednesday that a security incident at third-party analytics provider Amplitude exposed contact data belonging to a “small subset” of its customers, according to Cryptopotato. The Nasdaq-listed exchange said it found no evidence of unauthorized access to its own systems and that customer funds were not affected.
What Coinbase has and hasn’t said
Coinbase’s support account addressed the incident directly on X, asserting that the exchange itself had not been breached. The company did not say when the Amplitude incident occurred, what kinds of contact data were involved, or which other Amplitude customers were affected.
Amplitude had not issued a public statement on how the breach occurred as of the reports. Cointelegraph said it contacted Coinbase for the number of customers affected and had not received a response by publication.
The gap between the two accounts is notable: Coinbase describes the exposure only in relative terms, while the 70,000-plus figure comes from an outside security researcher, not from the company. Even contact-only data carries risk. Exposed email addresses and phone numbers give attackers material for phishing and social engineering, particularly when messages imitate a brand customers already trust.
This is not Coinbase’s first data incident. In May 2025, the exchange disclosed a breach in which cybercriminals bribed overseas customer support agents to steal personal data, and it refused a $20 million ransom demand in favor of a $20 million bounty for information leading to the attackers’ arrest. A later filing with the Maine attorney general put that count at 69,461 customers, with names, addresses, masked Social Security numbers and government ID images exposed. Coinbase estimated reimbursement and remediation costs at up to $400 million, Decrypt reported.
The wider vendor-risk problem
The Coinbase disclosure landed on the same day as other data-security reports in and around crypto. Bithumb, South Korea’s second-largest crypto exchange, was still working to determine the full scope of an incident on its internal work platform after abnormal access was detected on October 27, per Yonhap News Agency. Brokerage Daishin Securities reported a leak involving 38,490 customers, with names, email addresses and phone numbers among the exposed data, and Mirae Asset Global Investment was also affected.
Third-party providers have become a recurring weak point. Hardware wallet maker Trezor said a breach at shipping provider ShipMonk exposed the names, phone numbers and home addresses of 67,000 U.S. customers, on top of nearly 14,000 disclosed earlier — some records dating to 2019, years after ShipMonk had told Trezor they were deleted. Trezor also warned in September about a phishing email tied to a third-party provider that falsely claimed an STM32 microcontroller flaw could put wallet recovery phrases at risk; the company said it took down the phishing domain.
Why it matters
For individual customers, the practical concern is not the exchange’s balance sheet but the inbox and the phone. A message that names a real exchange and arrives on a real registered address is far harder to dismiss, and stolen contact records stay useful for years because people rarely change numbers or move.
For Coinbase, the episode is a test of how it handles a smaller, more contained event than the 2025 breach, which cost it up to $400 million in estimated remediation. Vendors such as analytics providers often sit outside the perimeter a company monitors most closely, yet they handle exactly the customer identifiers attackers want. How quickly Amplitude explains the incident, and how precisely Coinbase scopes the affected group, will shape whether this reads as a contained vendor issue or a broader lapse.
What to watch
Amplitude has yet to publish a public account of how the breach happened, and Coinbase has not given a customer count. Bithumb is still determining how many customers were affected and which details were exposed, making further disclosures from Seoul the next concrete data point in this cluster of incidents.
Frequently Asked Questions
Did Coinbase itself get hacked?
Coinbase says no. It stated that it found no evidence of unauthorized access to its systems and that customer funds were not affected, attributing the exposure to a security incident at analytics vendor Amplitude.
How many Coinbase customers were affected?
Coinbase has not disclosed a number, describing the group only as a “small subset” of customers. Separately, SlowMist’s chief information security officer, known as “23pds,” claimed hackers obtained contact information of more than 70,000 users.
What kind of data was exposed?
Coinbase said customer contact data was involved but did not specify which details. Exposed email addresses and phone numbers can still be used for phishing and social engineering, so customers should treat unexpected messages with caution.
What happened in Coinbase’s 2025 breach?
In May 2025, Coinbase disclosed a separate breach in which cybercriminals bribed overseas customer support agents to steal personal data. A later filing with the Maine attorney general put the affected customer count at 69,461, and the exchange estimated reimbursement and remediation costs at up to $400 million.
Sources: CryptoPotato, Cointelegraph, Decrypt
