Coinbase Customer Contact Info Compromised in Third-Party Analytics Breach; Funds Remain Secure

Key Details

• Coinbase confirmed that a security incident at its analytics vendor, Amplitude, resulted in the exposure of contact information for a small group of customers.
• The cryptocurrency exchange clarified that its internal systems were not breached and that all customer funds are safe.
• This incident follows a separate, more significant breach disclosed by Coinbase 17 months ago involving compromised support staff.

Coinbase has reported that a security event at Amplitude, a third-party analytics provider, affected the contact details of a “small subset” of its user base. The company emphasized that its own infrastructure was not compromised during the incident.

“Coinbase has not had a data breach,” the company’s support account stated in a tweet on Tuesday night. “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”

Coinbase has not had a data breach.

Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.

We’ve found no evidence of unauthorized access to Coinbase systems, and…

— Coinbase Support (@CoinbaseSupport) October 28, 2026

The exchange confirmed it found no evidence of unauthorized access to its internal systems and stated that customer funds were “not impacted.” Coinbase is currently notifying the affected users and relevant regulators in accordance with legal requirements.

Specific details regarding the total number of affected customers, the exact nature of the exposed contact data, or the timing of the incident were not disclosed. Additionally, the company did not identify the other clients of Amplitude impacted by the breach.

The 2025 Coinbase Incident

In May 2025, Coinbase managed a much more severe security crisis. At that time, the company revealed that hackers had successfully bribed overseas customer support employees to access the personal information of less than 1% of its active monthly users. Coinbase notably rejected a $20 million ransom demand, opting instead to offer a $20 million bounty for information that would lead to the arrest of the perpetrators.

Regulatory filings with the Maine attorney general later clarified that 69,461 customers were affected, with exposed data including names, addresses, masked Social Security numbers, and government-issued identification images.

The vulnerability of crypto firms to third-party partner breaches remains a recurring issue. In September, hardware wallet manufacturer Trezor reported that a breach at its shipping provider, ShipMonk, had compromised the names, phone numbers, and home addresses of 67,000 U.S. customers. This followed another disclosure in August, with some exposed records dating back as far as 2019, despite previous assurances from ShipMonk that such data had been deleted. Trezor advised its users to remain vigilant against phishing attempts and potential physical security risks.

Cybersecurity consultant David Sehyeon Baek previously noted to Decrypt that the theft of physical identifiers like names and home addresses is particularly dangerous, as it allows bad actors to locate individuals, and the utility of such data persists for years since contact information and residences change infrequently.

Source link