Coinbase says Amplitude security incident exposed contact data of 'small subset' of customers
Key Takeaways
- •Coinbase stated that a security incident at analytics vendor Amplitude exposed the contact data of a small subset of its customers, and that other Amplitude clients were affected as well.
- •The exchange found no signs of unauthorized access to its own systems, said customer funds were not touched, and is notifying impacted users and regulators as required by law.
- •SlowMist's chief information security officer claimed hackers obtained contact information for more than 70,000 Coinbase users, but Coinbase has not confirmed that figure, saying only that a small subset was involved.
- •Coinbase has not disclosed how many users were affected, which data fields were exposed, or when the Amplitude incident took place.
- •The leaked contact data creates phishing and social-engineering risks, following precedents such as a May 2025 Coinbase breach that cost the company between $180 million and $400 million to address.
Coinbase said in a late Tuesday statement that a security incident at analytics vendor Amplitude compromised contact data for a “small subset” of its customers, while denying any breach of the exchange’s own systems. The company added that other Amplitude clients had also been affected.
The episode highlights a recurring weak point for crypto firms: customer data shared with third-party tools can be exposed even when a company’s own systems show no signs of intrusion.
“Coinbase has not had a data breach,” the exchange’s support account wrote in a post on X. The post characterized the episode as a security incident at Amplitude, an analytics vendor, that “impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
Coinbase said it found no signs of unauthorized access to its systems and that customer funds were not touched. The company is notifying impacted customers and regulatory bodies as required by law. It has not disclosed how many users were affected, which data fields were exposed, or when the Amplitude incident occurred — details that remain outstanding as the notification process proceeds.
SlowMist executive claims more than 70,000 users hit
About 30 minutes before Coinbase published its statement, 23pds, chief information security officer at blockchain security firm SlowMist, wrote on X that the breach was confirmed and that hackers had obtained contact information for more than 70,000 users. The same post said it was not immediately clear whether passwords or funds had been stolen.
Coinbase has not confirmed the 70,000 figure, reiterating only that a “small subset” of its customers was involved. With the exchange offering no independent tally, the gap between the two characterizations remained unresolved at publication.
Leaked customer lists give scammers a ready phishing target
Exposure of contact details leaves passwords, keys, and funds untouched, but such data is fodder for phishing and social engineering. For Coinbase users, the concern is grounded in precedent: their contact information has surfaced in earlier incidents and fueled impersonation schemes.
A similar problem struck hardware wallet maker SafePal in August 2026, when an access control vulnerability exposed order data for around 39,798 customers. SafePal warned — as reported by Cryptopolitan — that scammers can use stolen details to place fake support calls, offer bogus refunds, send sham software update requests, and distribute links to cloned phishing sites.
Coinbase customers have faced comparable threats before. In May 2025, the exchange disclosed a breach in which criminals bribed overseas support agents to hand over personal data for a subset of users. Coinbase said the criminals planned to impersonate the exchange and trick people into sending crypto. The company set aside between $180 million and $400 million to address the incident and compensate customers, and it offered a $20 million reward for information leading to arrests.
On-chain investigator ZachXBT estimated in February 2025 that such scams cost roughly $300 million per year, saying Coinbase users had lost more than $65 million to them in two months.
In March 2026, the same SlowMist executive, 23pds, criticized an official Coinbase Commerce page that asked users to type in their recovery phrases, calling it “extremely foolish” to ask users to send a mnemonic phrase in order to check assets.
