TL;DR
Coinbase said an Amplitude security incident exposed contact information for a small subset of customers, while its own systems showed no unauthorized access.
Customer funds were unaffected, and Coinbase is notifying affected users and regulators while reviewing the incident and its third-party exposure.
The company has not disclosed the number of affected customers, the contact fields exposed or when the incident occurred, leaving the scope limited to confirmed contact-data exposure.
Coinbase said a security incident at analytics provider Amplitude exposed contact information for a small subset of customers, while its infrastructure was not breached. In an official disclosure , the exchange said it found no evidence of unauthorized access to Coinbase systems and that customer funds were unaffected. The incident is a third-party data exposure rather than a confirmed compromise of Coinbase’s systems , keeping vendor security relevant for users of the Coinbase platform .
Coinbase has not had a data breach.
Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.
We’ve found no evidence of unauthorized access to Coinbase systems, and…
— Coinbase Support (@CoinbaseSupport) October 28, 2026
Amplitude Incident Leaves Scope of Exposed Data Unclear
Coinbase has not disclosed how many customers were affected, which contact fields were exposed or when the incident occurred. It described the group only as a small subset and said other Amplitude customers were impacted. The disclosure establishes exposure of customer contact data but does not support claims that passwords, private keys or account balances were compromised. Coinbase said it is notifying affected customers and relevant regulators as its review continues.
Contact information can still carry security implications even when funds and account credentials remain untouched. Email addresses or phone numbers can become useful in impersonation and social-engineering campaigns, although Coinbase has not specified which fields were involved. The primary confirmed risk is exposure of contact information, not direct access to crypto assets or Coinbase accounts. The distinction matters given earlier concerns around Coinbase-linked pages and recovery-phrase security .
The latest incident is separate from Coinbase’s 2025 customer-data breach, which involved external support personnel and exposed sensitive personal records. That earlier episode later became associated with phishing and impersonation attempts targeting users. The Amplitude case currently has a narrower confirmed scope and a different origin, making direct comparisons inappropriate without more disclosure. Previous phishing schemes targeting Coinbase customers nevertheless show why leaked contact information can remain relevant even when trading systems are unaffected.
Coinbase’s response centers on separating the vendor incident from its own security perimeter. The company rejected characterizing the event as a Coinbase data breach, while confirming that some customer information was exposed through Amplitude. For now, the key unresolved questions are the number of affected customers, the exact contact fields involved and the timing of the exposure. Until those details emerge, the confirmed impact remains limited to contact data, while broader concerns around social-engineering attacks against Coinbase users provide context rather than evidence of losses from this incident.
