Coinbase says it was not breached, but vendor Amplitude exposed customer contact details

Coinbase says it was not breached, but a security incident at analytics vendor Amplitude exposed contact information for a small subset of its customers. The exchange said on October 28, 2026, that no customer funds were affected and that it is notifying affected users and regulators. It did not say how many customers were hit or which details were exposed.

Amplitude leak highlights risks of third-party analytics providers

The Amplitude leak underscores a persistent cybersecurity challenge for cryptocurrency companies: protecting user information requires more than securing exchange-operated systems. External vendors that process customer data can introduce additional points of exposure, even when a company’s core infrastructure shows no signs of compromise.

Analytics platforms help businesses measure how customers interact with websites and applications. Depending on how these services are configured, the information they process may include identifiers and other customer-related details. When a security incident affects a vendor, the potential consequences depend on what information was accessible and how the incident occurred.

Coinbase has not publicly established the full scope of the exposure. The exchange has not confirmed the number of affected customers or provided a detailed breakdown of the information involved. Consequently, claims about specific leaked fields or the extent of any subsequent misuse should be treated cautiously until verified.

For customers, the immediate concern is the possibility of impersonation attempts. Attackers who obtain contact information associated with a cryptocurrency account may use it to craft convincing messages that appear to come from an exchange’s support or security team.

Such messages can pressure recipients into revealing passwords, authentication codes or other sensitive information. A reported exposure of contact details does not, by itself, establish that attackers obtained account credentials or can access cryptocurrency wallets.

The Amplitude leak therefore highlights the importance of separating confirmed consequences from potential downstream risks. Coinbase says customer funds were not affected, but the ultimate significance of the incident will depend partly on the findings of its investigation and the vendor’s response.

Coinbase’s previous breach puts the latest incident under scrutiny

The latest disclosure also brings renewed attention to Coinbase’s cybersecurity record following a separate incident disclosed in May 2025.

In a filing with the US Securities and Exchange Commission, Coinbase reported that a threat actor had sought payment to prevent the release of information allegedly obtained from certain customer accounts and internal documentation. The company said the attacker appeared to have bribed overseas contractors or employees working in customer-support roles to obtain information they could access through their jobs.

Coinbase estimated that remediation expenses and voluntary customer reimbursements associated with that incident could range from $180 million to $400 million, according to its regulatory filing. The estimate was preliminary and subject to change as the investigation progressed.

The 2025 incident differed from the current Amplitude leak in its reported circumstances. The earlier case involved people allegedly exploiting authorized access to internal information, whereas the latest disclosure concerns a security incident at an external analytics provider.

The distinction matters when assessing the nature of a security failure. A compromise involving an employee or contractor with legitimate access raises different control questions from an incident involving a third-party service provider. Both, however, demonstrate why companies must monitor who can access sensitive information and how that information is shared.

Coinbase has not said that the two incidents are connected. There is also no confirmed evidence in the available reporting that the current exposure resulted in unauthorized access to Coinbase’s trading infrastructure.

Financial sector faces fresh data security concerns

The Amplitude leak emerged as other financial institutions reported security incidents, adding to concerns about the protection of personal information across the financial services industry.

In South Korea, cryptocurrency exchange Bithumb was investigating a breach involving its internal mobile work platform. The exchange was examining the scope of the incident, including whether customer information had been exposed. Separately, brokerage firm Daishin Securities confirmed that personal and credit information belonging to 38,490 customers had been leaked.

The incidents have different reported circumstances and should not be treated as evidence of a coordinated attack. Nevertheless, their timing illustrates the broad range of systems that can become potential targets, from employee communication platforms to customer-facing services and external analytics tools.

For crypto exchanges, where customer trust is central to business operations, a data exposure can create reputational and operational challenges even without evidence of stolen assets. Customers may question whether their information is adequately protected, while companies must determine what happened, identify affected individuals and meet applicable notification requirements.

The Amplitude leak also reinforces the need for businesses to evaluate third-party vendors before and during their relationships. Security reviews, data minimization, restricted access permissions and clear incident-reporting procedures can help limit exposure when a supplier experiences a problem.

Coinbase has said it is notifying affected customers and regulatory agencies as required. However, important questions remain unanswered, including the number of people affected, the precise categories of exposed information and the circumstances surrounding the vendor’s security incident.

Until further details emerge, customers should remain alert to unsolicited messages claiming to be from Coinbase. They should avoid clicking suspicious links, sharing authentication codes or transferring cryptocurrency in response to unexpected security warnings.

Ultimately, the Amplitude leak is a reminder that protecting digital assets and protecting the personal information associated with them are related but distinct responsibilities. Coinbase’s assurance that customer funds remain safe addresses one immediate concern; determining the full extent of the data exposure remains an important next step.