Coinbase Amplitude breach: contact data exposed

A security incident at analytics vendor Amplitude exposed contact data for a small subset of Coinbase customers. Coinbase says its own systems and customer funds were untouched.

A Coinbase Amplitude breach has brought customer contact data back into focus, though this time the exchange says the trouble began beyond its own walls. Coinbase confirmed that a security incident at Amplitude, a third-party analytics provider, exposed contact information for a small slice of its user base. The company moved quickly to separate that exposure from its own infrastructure.

What happened in the Coinbase Amplitude breach

According to Coinbase, the incident occurred at Amplitude rather than on Coinbase systems. The exchange described the affected group as a small subset of customers and said the same vendor event also touched data belonging to other Amplitude clients.

Coinbase said it uncovered no signs of unauthorized access to its own systems and that customer funds were unaffected. The company is now reaching out to affected customers and alerting regulators, as legal requirements demand.

A number of significant details have not been made public. Coinbase has not disclosed how many customers were involved, which specific contact fields were exposed, or when the incident occurred. It also did not name the other Amplitude customers caught up in the event, and Cointelegraph reported that it had asked Coinbase for the number of affected users without receiving a response by publication time. Accounts also vary on the exact day the statement appeared, with one outlet citing a Tuesday night tweet and another pointing to Wednesday.

Why it matters for Coinbase users

Contact data may seem trivial beside passwords or private keys, yet it is the raw material for phishing and social-engineering campaigns. An email address or phone number hands an attacker a way in — a convincing message, a fake support call, a link that looks legitimate. Even when funds and credentials remain safe, that exposure carries real value for criminals.

The context here is a pattern, not a one-off. Crypto firms keep finding that their customer data can leak through partners whose own security they do not fully control. That is the supply-chain problem in plain terms: strong core infrastructure does not automatically protect users from a weaker link elsewhere in the chain.

Security analyst David Sehyeon Baek has made a related point about how durable this kind of data is. A letter bearing a name and home address, he noted, tells the recipient that they can be located, and stolen records stay useful for years because people seldom relocate or change their phone numbers.

The bigger pattern of exposed customer data

Coinbase has faced a more serious episode in the past. In May 2025, it revealed a separate breach in which cybercriminals paid off overseas customer support agents to steal data affecting less than 1% of monthly transacting users. In that case Coinbase turned down a $20 million ransom demand and offered a $20 million bounty for information leading to the attackers' arrest.

A later filing by the Maine attorney general put the number of customers affected in that May 2025 incident at 69,461, with names, addresses, masked Social Security numbers and government ID images exposed. Coinbase put reimbursement and remediation costs for that breach at as much as $400 million.

Other firms have logged similar problems:

Trezor disclosed in September that a breach at shipping provider ShipMonk exposed the names, phone numbers and home addresses of 67,000 U.S. customers, following nearly 14,000 revealed in August. Certain records went back as far as 2019, long after ShipMonk had assured Trezor they had been deleted.
Daishin Securities disclosed a leak of personal and credit information belonging to 38,490 customers.
Bithumb is looking into whether a breach of its internal work platform exposed customer information.
Financial authorities launched an inspection into a data breach at Mirae Asset Global Investments.

The Coinbase Amplitude incident also landed alongside those reports from South Korean financial firms, which makes the timing notable even though the cases appear unrelated.

What to watch next

The most useful signals will come from Coinbase itself. Watch for a disclosure that puts a number on affected customers and names the contact fields involved, since that determines how usable the data is for targeted phishing. A clear timeline would also help users judge whether their own accounts fall inside the window.

On the defensive side, treat any message that references your Coinbase account with suspicion, especially if it asks you to confirm details, click a link or call a number. Coinbase has said funds were not affected, and that claim is worth holding onto — but the contact data exposure is the kind of thing that fuels impersonation attempts.

For traders and long-term holders, the practical read is that this is a data-handling event, not a solvency or custody event as described by the company. The risk to monitor is follow-on fraud aimed at customers, and the reputational cost if Coinbase stays quiet on the specifics. Vendor risk is now part of the security story for every exchange, and how Coinbase handles the disclosure will shape how that story is told.

FAQ

What is the Coinbase Amplitude breach?

It concerns a security incident at Amplitude, a third-party analytics provider used by Coinbase. According to Coinbase, the event exposed contact data for a small subset of its customers, along with data of other Amplitude customers, and its own systems were not breached.

Why did Coinbase say customer funds were not impacted?

Coinbase said it uncovered no signs of unauthorized access to its systems and that customer funds were untouched. The company attributes the incident to the vendor, which explains why the exposure covers contact information only, not account credentials or balances.

How many customers were affected by the Amplitude incident?

Coinbase has not disclosed a number. It also has not specified which contact-data fields were exposed or when the incident occurred, and it has not named the other Amplitude customers involved.

Coinbase Amplitude Breach Exposes Contact Data, Not Funds