<img width="1920" height="1080" src="https://blockchainreporter.net/wp-content/uploads/2026/09/coinbase1.webp" alt="coinbase1 main" style="float: right; margin-left: 5px;" title="Coinbase Data Breach: Exchange Says Its Systems Were Not Compromised After Amplitude Vendor Leak 21">
<p>More than 70,000 Coinbase customers may have had their contact information exposed on October 28, 2026 — but not through a breach of the exchange itself. Coinbase’s support account said a security incident at Amplitude, a third-party analytics vendor, exposed a “small subset” of Coinbase customer contact data, and that Coinbase’s own systems were never compromised.</p>
<p>The clarification landed roughly half an hour after a security researcher described the event as a confirmed Coinbase data breach. The distance between the two statements is the story: the exchange frames the event as a vendor-side leak, while the researcher’s figure of more than 70,000 affected users remains unconfirmed by Coinbase.</p>
<p><a href="https://x.com/CoinbaseSupport/status/2115269375754133707" rel="noopener noreferrer nofollow">In its statement</a>, Coinbase Support named the vendor directly: “Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”</p>
<h2 id="what-coinbase-confirmed-and-what-it-left-out">What Coinbase Confirmed and What It Left Out</h2>
<p>Coinbase’s account rests on three specific assertions. The incident happened at Amplitude, not at Coinbase. Coinbase found no evidence of unauthorized access to its own internal systems. And customer funds were not affected.</p>
<p>The exchange added that it is notifying affected users and the relevant regulatory authorities in line with legal requirements. What the statement did not include is equally revealing: no count of affected users, no list of which contact fields were exposed, and no date for the Amplitude incident itself.</p>
<p>Amplitude is a product-analytics platform that companies use to track how users move through their apps and websites. Because it sits inside a customer’s product experience, its systems can hold identifiers such as email addresses and phone numbers for the companies it serves. That is why a failure at Amplitude can touch Coinbase customer data without Coinbase’s own databases ever being accessed.</p>
<p>That omission matters because the phrase “small subset” is doing the heavy lifting. Without a denominator, it cannot be checked against anything. A small subset of a very large user base can still be tens of thousands of people.</p>
<h2 id="where-the-70-000-figure-comes-from">Where the 70,000 Figure Comes From</h2>
<p>The number that circulated ahead of Coinbase’s response came from the chief information security officer at blockchain security firm SlowMist, who posts under the handle 23pds. He wrote that the breach was confirmed and that hackers had obtained contact information for more than 70,000 users.</p>
<p>His post also said it was not immediately confirmed whether passwords or funds were stolen. Coinbase has not adopted the 70,000 figure, and as of October 29 it had not published a count of its own.</p>
<p>The result is a gap a careful reader should hold onto: a claim of 70,000-plus affected users from a security researcher, set against an exchange that calls the same event a small subset and attaches no number. Both statements can be true. Neither has been reconciled.</p>
<table>
 <thead>
  <tr>
   <th>Status</th>
   <th>Detail</th>
   <th>Source</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Confirmed</td>
   <td>Incident occurred at Amplitude, a third-party analytics vendor</td>
   <td>Coinbase Support</td>
  </tr>
  <tr>
   <td>Confirmed</td>
   <td>No evidence of unauthorized access to Coinbase’s internal systems</td>
   <td>Coinbase Support</td>
  </tr>
  <tr>
   <td>Confirmed</td>
   <td>Customer funds were not affected</td>
   <td>Coinbase Support</td>
  </tr>
  <tr>
   <td>Claimed</td>
   <td>Hackers obtained contact information for more than 70,000 users</td>
   <td>SlowMist 23pds</td>
  </tr>
  <tr>
   <td>Unknown</td>
   <td>Exact user count, exposed fields, and date of the Amplitude incident</td>
   <td>Not disclosed</td>
  </tr>
 </tbody>
</table>
<h2 id="a-busy-week-for-crypto-and-financial-data-breaches">A Busy Week for Crypto and Financial Data Breaches</h2>
<p>The Amplitude incident did not happen in isolation. On October 27, South Korea’s second-largest exchange, Bithumb, confirmed that an outside party accessed its internal mobile groupware system and leaked personal data. The country’s Financial Supervisory Service is investigating that case alongside intrusions at Mirae Asset Global Investments and Daishin Securities.</p>
<p>Daishin Securities disclosed a concrete figure of its own: personal and credit information on 38,490 customers was leaked. If SlowMist’s 70,000 figure for the Coinbase vendor leak is accurate, the exposure would be roughly 1.8 times the size of the largest disclosure from the South Korean cases.</p>
<p>The pattern across these incidents is consistent. Attackers are targeting third-party vendors and internal collaboration tools rather than the customer-facing platforms themselves, which lets them obtain data without defeating a major exchange’s own defenses. For the exchange side of that trend, BlockchainReporter covered the Bithumb confirmation in detail <a href="https://blockchainreporter.net/bithumb-data-breach-south-korea-cyberattacks/" rel="noopener noreferrer nofollow">here</a>.</p>
<p>The timing compounds the concern. Three named financial institutions disclosed or confirmed intrusions within roughly 48 hours, and two of them — Bithumb and Daishin — did so on the same day. Investigators have not said whether the incidents are connected, but the clustering is enough to keep pressure on exchanges and the vendors they depend on.</p>
<h2 id="what-coinbase-users-should-do">What Coinbase Users Should Do</h2>
<p>Coinbase has said customer funds were not affected and that it found no evidence its systems were accessed. On the facts available, there is no reason to believe account balances or credentials held by Coinbase were compromised.</p>
<p>The realistic risk is phishing. Exposed contact data — email addresses and phone numbers — is exactly what attackers use to send targeted messages that imitate Coinbase. A user who receives a text or email claiming to be from Coinbase should not click links inside it, and should log in only by typing coinbase.com directly rather than following an inbound link. Keeping two-factor authentication enabled and using a unique password on the account adds a second layer that contact data alone cannot bypass.</p>
<p>The incident is also a reminder of how quickly a vendor problem can be reported as an exchange hack. For a practical guide on separating real incidents from rumor, BlockchainReporter has a walkthrough on <a href="https://blockchainreporter.net/how-to-verify-crypto-news-and-rumors/" rel="noopener noreferrer nofollow">verifying crypto news</a>.</p>
<h2 id="frequently-asked-questions">Frequently Asked Questions</h2>
<div class="accordion__wrapper">
 Was Coinbase hacked? 
 <p>No. Coinbase said its own systems were not breached. The security incident occurred at Amplitude, a third-party analytics vendor that Coinbase and other companies use.</p> What data was exposed in the Coinbase Amplitude incident? 
 <p>Coinbase said a small subset of customer contact data was affected, but it has not published a list of the specific fields or a count of affected users.</p> How many Coinbase users were affected? 
 <p>Coinbase has not confirmed a number. SlowMist’s security officer, 23pds, claimed hackers obtained contact information for more than 70,000 users, a figure Coinbase has not adopted.</p> Are Coinbase customer funds safe? 
 <p>Coinbase said customer funds were not affected and that it found no evidence of unauthorized access to its internal systems.</p> What should Coinbase users do now? 
 <p>Watch for phishing messages that imitate Coinbase. Do not click links in unexpected emails or texts, and log in only by typing coinbase.com directly.</p>
</div>
<div class="disclaimer">
 <p>Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.</p>
</div>

Coinbase Data Breach: Exchange Says Its Systems Were Not Compromised After Amplitude Vendor Leak

Table of Contents

BlockchainReporter

Other articles published on Oct 29, 2026

Join our free newsletter for daily crypto updates!