Coinbase Blames Vendor Amplitude for Customer Data Leak

Published October 28, 2026, 08:50 AM PKT. Based on a Coinbase Support statement on X (primary source) and reporting by CoinDesk and The Defiant (secondary sources), all published October 28, 2026.

Coinbase said on October 28, 2026 that a security incident at Amplitude, a third-party analytics vendor, exposed contact data belonging to a small subset of its customers, and denied that its own systems were breached. Customer funds were not affected, the exchange said, and it is notifying affected customers and regulators. The statement landed hours after screenshots claiming a major Coinbase breach circulated online, and it was confirmed by CoinDesk the same morning, turning a contested overnight claim into a confirmed company disclosure with one large figure still unresolved.

Coinbase denies its own systems were breached

Coinbase Support posted the statement on X on October 28, 2026, and CoinDesk reported it the same morning. The statement read, in full: "Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We have found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations."

Three limits in that statement matter. First, Coinbase did not say how many customers were affected, only that the group was a small subset. Second, it did not say exactly which contact-data fields were involved. Third, it did not describe how the Amplitude incident happened. CoinDesk reported that Coinbase is informing impacted customers by email as required by law, and that the exchange stressed its systems have not detected any unauthorized access. CoinDesk said it had reached out to Coinbase for further comment. The Defiant reported the same statement on October 28, 2026, noting that the exchange said customer funds were unaffected and that it is notifying impacted users and regulators.

The disputed 70,000 figure

The overnight claim that forced the statement came from SlowMist chief information security officer 23pds, who said a Coinbase data breach was confirmed and that hackers obtained contact information for more than 70,000 users, according to Phemex News reporting on October 28, 2026. That claim is not confirmed by Coinbase, whose statement describes only a small subset of customers and gives no number. Readers should also note that the 70,000 figure resembles the scale of a different, earlier Coinbase disclosure: in May 2025 the exchange said criminals had obtained customer data affecting tens of thousands of users. Nothing in the October 28 statement ties the 70,000 figure to the Amplitude incident, and this article does not treat it as established.

The distinction between a vendor incident and an exchange breach is the heart of the story. Coinbase says the incident sits with Amplitude, not with its own systems, and that no unauthorized access to Coinbase systems has been found. That framing, if accurate, means attackers did not reach trading systems, wallets, passwords or private keys through Coinbase itself. But it does not make the exposure harmless, because contact data held by a vendor is still customer data once it leaves the vendor.

The phishing risk in exposed contact data

Exposed email addresses and phone numbers are raw material for phishing and social-engineering attacks, CoinDesk noted, even when passwords, private keys and funds were not compromised. A scammer who knows a victim uses Coinbase can craft messages that look like exchange support, account security alerts or withdrawal confirmations, and can time them to the news of a real incident. Coinbase customers who receive unexpected messages claiming to be from the exchange should therefore treat them with suspicion, verify any request through the exchange's own app or official channels rather than through links in messages, and remember that the company says it is notifying affected customers directly by email.

Coinbase has recent experience of exactly this attack pattern. In May 2025 the exchange disclosed that criminals bribed overseas support personnel to obtain customer information they could use while pretending to represent the company, according to crypto.news reporting on that disclosure. The stolen records then included contact details, government identification images, masked financial identifiers and account information, while private keys and login credentials were not obtained and the stolen access did not itself allow attackers to move customer funds. The exchange rejected a ransom demand, announced a matching 20 million dollar bounty for information leading to arrests, and said it would voluntarily reimburse retail customers who sent funds to scammers as a direct result of that incident. The October 28 Amplitude incident is a separate event with a different mechanism, a vendor incident rather than bribed support staff, but the customer defense is the same: assume phishing attempts will follow the disclosure.

A wider breach wave, and what is still unknown

The Coinbase disclosure lands in the middle of a wider wave of financial-sector data incidents. Hours earlier, MABOnChain reported that South Korean exchange Bithumb said its in-house mobile system was hacked and personal information leaked, joining brokerage Daishin Securities, which confirmed personal and credit information belonging to 38,490 customers was exposed, and asset manager Mirae Asset in a new round of disclosures. CoinDesk also noted the South Korean disclosures in its October 28 report, including Bithumb and Daishin. The incidents are separate, with different companies, systems and countries involved, and nothing published so far links the Amplitude incident to the South Korean breaches, but together they show how much customer data now sits with vendors, contractors and connected systems outside any one company's core infrastructure.

Four questions remain open. First, how many Coinbase customers are affected, and whether the number is anywhere near the claimed 70,000. Second, which contact-data fields were exposed, since names, email addresses and phone numbers carry different phishing risks. Third, how the Amplitude incident happened, and whether other Amplitude clients beyond Coinbase are affected. Fourth, whether Amplitude itself has issued its own statement, which had not been reported in the coverage reviewed for this article. What to watch next is concrete: a Coinbase or Amplitude statement giving the affected count and the exposed fields, customer notification emails reaching the affected group, and any regulator comment on the vendor incident.

This article is news reporting and is not investment advice.

Sources

• Coinbase Support on X, Statement on the Amplitude security incident (October 28, 2026), primary source
• CoinDesk, Coinbase says user funds are safe after vendor exposes customer data (October 28, 2026), secondary source
• The Defiant, Coinbase Denies Systems Breach, Cites Amplitude Contact-Data Incident (October 28, 2026), secondary source
• MABOnChain, Bithumb Hacked as Personal Data Leaks in Korea Breach Wave (October 28, 2026), secondary source