Amplitude

SafePal

2026

Coinbase has denied reports of a new data breach after a security incident at third-party analytics provider Amplitude exposed contact information belonging to a limited number of its customers.
The exchange <a href="https://x.com/CoinbaseSupport/status/2115274731310002356" rel="noopener noreferrer nofollow">clarified the incident on October 28</a>, stating that its internal systems had not been compromised and customer funds remained unaffected. The exposure involved information processed by Amplitude, which also handles data for other companies.
The response followed the circulation of alleged Coinbase breach notifications on social media, including unverified claims that more than 70,000 users were affected and that some customers had lost cryptocurrency.
Coinbase has not confirmed those figures or reported any asset losses connected to the vendor incident.
<h2 id="amplitude-incident-exposes-customer-contact-details">Amplitude Incident Exposes Customer Contact Details</h2>
The security incident affected a small subset of Coinbase customer contact information, potentially including email addresses and telephone numbers.
Coinbase identified Amplitude, an external analytics provider, as the source of the exposure rather than its own trading, custody or account-management infrastructure.
The company has found no evidence of unauthorized access to its internal systems and maintains that customer assets remain secure.
Coinbase is notifying affected customers and relevant regulators in accordance with applicable legal requirements. However, it has not disclosed the number of individuals involved, the precise timeline of the intrusion or the method used to access Amplitude’s systems.
The exchange also confirmed that <a href="https://status.amplitude.com/history" rel="noopener noreferrer nofollow">information belonging to other Amplitude customers</a> was affected, indicating that the incident extended beyond Coinbase’s data.
The absence of a direct exchange breach does not eliminate the privacy implications of exposed contact information, which can be used to target cryptocurrency holders through impersonation attempts.
<h2 id="claims-of-70-000-affected-users-remain-unsubstantiated">Claims of 70,000 Affected Users Remain Unsubstantiated</h2>
Social media posts circulating alongside the latest incident referenced approximately 70,000 affected Coinbase customers, a figure associated with an earlier and separate security breach.
In May 2025, Coinbase disclosed that criminals had bribed overseas customer support personnel to obtain account information for social-engineering attacks.
A subsequent <a href="https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/f61fae18-f669-499e-9a87-f4d323d281f8.html" rel="noopener noreferrer nofollow">regulatory notification</a> identified 69,461 affected individuals. The incident prompted a $20 million ransom demand, which Coinbase refused, and substantial remediation and reimbursement costs.
That earlier breach also triggered <a href="https://cryptoadventure.com/binance-kraken-thwarted-social-engineering-attacks-similar-to-coinbase-hack/" rel="noopener noreferrer nofollow">security concerns across rival exchanges</a>, including attempted employee recruitment schemes targeting Binance and Kraken.
The October 2026 Amplitude incident is distinct from the 2025 insider case. Coinbase has not established a connection between the two events or confirmed that the earlier customer count applies to the latest exposure.
<h2 id="coinbase-customers-face-potential-phishing-risks">Coinbase Customers Face Potential Phishing Risks</h2>
Exposed contact details can allow criminals to construct convincing phishing emails, fraudulent security alerts and telephone impersonation attempts.
Attackers may exploit legitimate breach notifications to persuade customers to reveal passwords, disclose two-factor authentication codes or transfer cryptocurrency to addresses presented as secure accounts.
The incident follows a series of customer-data breaches affecting cryptocurrency wallet providers throughout 2026. In January, <a href="https://cryptoadventure.com/ledger-users-targeted-in-phishing-scam-following-global-e-data-breach/" rel="noopener noreferrer nofollow">Ledger customers</a> faced targeted phishing attacks after a breach at e-commerce partner Global-e exposed personal and order information. SafePal disclosed an order-tracking vulnerability in August that exposed data belonging to 39,798 customers, while a <a href="https://cryptoadventure.com/trezor-shipmonk-breach-expands-to-67000-more-u-s-customers/" rel="noopener noreferrer nofollow">Trezor shipping partner breach</a> affected more than 80,000 buyers.
Most recently, <a href="https://cryptoadventure.com/keystone-data-breach-exposes-customer-addresses-and-purchase-details/" rel="noopener noreferrer nofollow">Keystone suffered a data breach</a> in October, exposing customer names, addresses and purchase records through its online store, while Foundation Passport users were <a href="https://cryptoadventure.com/foundation-passport-users-targeted-by-fake-wallet-recall-phishing-emails/" rel="noopener noreferrer nofollow">targeted by fake wallet recall phishing emails</a>. Although the incidents involved different systems and attack methods, the stolen information can enable highly targeted phishing and impersonation attempts against cryptocurrency holders.
Coinbase advises customers to access its services directly rather than follow unexpected links or instructions from unsolicited messages. The exchange does not ask users to disclose recovery phrases, authentication codes or passwords to customer support representatives.
Customers who receive suspicious communications can verify their account status through the official Coinbase application or support website.
Coinbase is continuing customer notifications and regulatory reporting related to the Amplitude incident. The number of affected customers and the full categories of exposed information have not yet been publicly established.
The post <a href="https://cryptoadventure.com/coinbase-denies-data-breach-as-amplitude-vendor-exposes-customer-information/" rel="noopener noreferrer nofollow">Coinbase Denies Data Breach as Amplitude Vendor Exposes Customer Information</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Coinbase Denies Data Breach as Amplitude Vendor Exposes Customer Information

Table of Contents

Crypto Adventure

Other articles published on Oct 28, 2026

Join our free newsletter for daily crypto updates!