Amplitude Breach Exposes Contact Data of 70,000+ Coinbase Users

SlowMist Flags 70,000+ Exposed Contacts

Coinbase Global, the largest US-listed crypto exchange, disclosed a customer data exposure on Wednesday, 28 October 2026, after a security breach at one of its service providers. The affected vendor is Amplitude, a data analytics platform that companies use to study how customers behave across their digital products. The exchange relies on the platform's software, and the breach on the vendor's side exposed contact information held about some Coinbase customers.

The first public estimate of the scale came from blockchain security firm SlowMist. Its information security lead, publishing under the handle 23pds, asserted that contact details tied to more than 70,000 Coinbase users had reached the hands of malicious actors. The exchange has not endorsed that number. Its own communication describes only a limited group of customers as affected, and the exact count remains unconfirmed.

Amplitude serves a broad corporate client base, and Coinbase said the vendor's breach affected other Amplitude customers in addition to the exchange. The incident therefore did not begin inside the exchange's own infrastructure. Reviews conducted after the disclosure found no evidence of unauthorized access to Coinbase's systems, the company said, and customer assets were not harmed.

What has not been made public is the technical detail behind the breach. The full set of data categories that left the vendor's environment has not been itemized either. Early discussion of the incident also left open whether passwords were compromised; nothing disclosed so far indicates that direct account access was taken. The confirmed exposure is narrower: contact information, the kind of data that lets an outsider address a real customer by name, by email or by phone.

Coinbase Points to Amplitude

The exchange laid out its position in a statement posted from its customer support account on X. The message said the incident traces back to a security breach at Amplitude, a vendor that provides data analytics services to multiple companies including Coinbase. No direct intrusion into Coinbase's internal systems and no data leak from them occurred, the statement said.

@CoinbaseSupport · X post

A statement posted from its customer support account on X.

View on X

The leaked information, according to the same notice, is limited to contact data that Amplitude held on some Coinbase customers. The exchange stressed that no traces of unauthorized access were found in its internal trading and customer asset management systems, and that customer assets remain fully protected. Coinbase said it immediately notified the customers affected and the relevant government and regulatory bodies, in line with its legal obligations, and is guiding them through the follow-up process.

The practical risk now is social engineering rather than direct account theft. Contact details in an attacker's hands make phishing material far more credible: a message can mimic a genuine Coinbase notification, cite a fake security warning or an account verification request, and push the recipient toward a malicious link. Personalized messages raise the success rate of such fraud attempts because they name the target and reference a service the target actually uses.

Defensive steps are conventional but worth restating. Users should sign in only through the official app or an address they type themselves, keep two-factor authentication enabled, avoid unexpected links and check any password reset request through official support channels before acting on it.

The Vendor, Not the Exchange

The picture that emerges is a vendor-dependency problem, not an exchange breach. Coinbase's own systems show no sign of compromise, yet customer data still left the orbit of the company that collected it, because a third-party analytics tool held a copy. Funds stayed untouched, and the loss is informational rather than financial. Against that, the unverified 70,000 figure and the undisclosed technical scope leave room for FUD in crypto circles until Coinbase itemizes exactly what was taken. Users uncomfortable holding funds on the venue while the scope is clarified can review the exact steps to Cash Out on Coinbase, fees and speed included, before deciding how much exposure they want to carry through a third-party incident like this one.