Coinbase said that a security incident involving third-party analytics provider Amplitude exposed contact data relating to a small subset of Coinbase customers. The cryptocurrency exchange said it had found no evidence of unauthorized access to its own systems, and that customer funds were not affected.
The company made the disclosure in an October 28 statement from its official Coinbase Support account. Its response drew a distinction between a compromise of a vendor’s information and a breach of the exchange’s trading or custody infrastructure.
What customer information was exposed?
Coinbase has not publicly specified the exact contact fields involved or the number of affected users. It described the impact as limited to a small subset of customers and noted that other Amplitude clients were also affected.
That means claims about a precise victim total or the theft of passwords and private keys are not supported by the exchange’s current statement. Coinbase said it is notifying affected customers and regulatory agencies in line with legal requirements.
Why a vendor incident matters
Contact data can create risks even when assets held on an exchange remain secure. Criminals who obtain identifying information may use it to make impersonation emails, text messages or phone calls appear more convincing. Whether any such campaigns are connected to this particular incident has not been established.
Users should access Coinbase through its known app or website when reviewing account alerts, rather than clicking unexpected links. Support staff do not need users to disclose wallet recovery phrases or authentication codes.
What Coinbase has not confirmed
The company has not detailed the date of the vendor intrusion, the complete data categories involved or the ultimate number of affected accounts. An expanded technical account from Amplitude or Coinbase would be required to establish those points.
The incident is distinct from previously reported attacks involving crypto firms. For additional context on privacy risks, see BlockBriefing’s investigation into a Bitcoin wallet privacy failure.
Primary source: Official Coinbase Support statement, October 28, 2026.
