Coinbase said a security incident at analytics vendor Amplitude compromised contact data for a “small subset” of its customers.
In a late Tuesday statement, it denied any breach of Coinbase’s own systems and said other Amplitude clients had also been affected.
SlowMist’s 23pds claims more than 70,000 were hit
“Coinbase has not had a data breach,” the exchange’s support account wrote on X. The post depicted it as a security incident at Amplitude, an analytics vendor, that “impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
Coinbase Support statement on the Amplitude security incident, posted on X on October 28, 2026.
Coinbase said it found no signs of any unauthorized access to its systems. The exchange said customer funds were not touched.
The company is notifying impacted customers and regulatory bodies as required by law. There’s no disclosed number of users affected, no list of exposed fields, and no date for the Amplitude incident.
About 30 minutes before Coinbase posted, 23pds, chief information security officer at blockchain security firm SlowMist, wrote on X that the breach was confirmed and that hackers had obtained contact information for more than 70,000 users.
It was not immediately confirmed if passwords or funds were stolen, the same post said. Coinbase has not confirmed the 70,000 figure, saying in its own statement that it was a “small subset” of customers.
Leaked customer lists give scammers a ready phishing target
Exposure of contact details leaves passwords, keys and funds untouched. But they are fodder for phishing and social engineering.
The same problem occurred with hardware wallet maker SafePal in August 2026, when an access control vulnerability exposed order data for around 39,798 customers. Scammers can use the stolen details to make fake support calls, offer bogus refunds, send sham software update requests and send links to cloned phishing sites, SafePal warned, reported Cryptopolitan .
Coinbase customers have had a similar experience. In May 2025, the exchange disclosed a breach in which criminals bribed overseas support agents to hand over personal data for a subset of users.
Coinbase said the criminals planned to use that list of customers to pretend to be the exchange and get people to send crypto. It set aside between $180 million and $400 million to fix the problem and pay back customers. It also offered a $20 million reward for information leading to arrests.
On-chain investigator ZachXBT reckoned the toll to be $300 million per year, with Coinbase users losing more than $65 million to such scams in two months, the investigator said in February 2025.
In March 2026, the same SlowMist executive, 23pds, said that an official Coinbase Commerce page that asked users to type in their recovery phrases was bad.
23pds said it was “extremely foolish” to ask users to send a mnemonic phrase to check assets.
If you’re reading this, you’re already ahead. Stay there with our newsletter .
