Crypto exchange Coinbase said a security incident at Amplitude, a third-party analytics vendor, affected contact data belonging to a “small subset” of its customers, while stressing that the exchange itself had not been breached and that customer funds were not affected. The disclosure comes 17 months after Coinbase said a breach involving bribed overseas support agents had exposed customer data.

The company sought to draw a clear line between the vendor's compromise and its own infrastructure. “Coinbase has not had a data breach,” the company's support account said in a tweet on Tuesday night. “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”

Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and… — Coinbase Support (@CoinbaseSupport) October 28, 2026

The truncated post ended mid-sentence after stating that no unauthorized access to Coinbase's systems had been found.

Coinbase said it had found no evidence of unauthorized access to its own systems and that customer funds were “not impacted.” The company said it is notifying affected customers and regulators in line with its legal obligations.

The exchange did not disclose how many customers were affected, what kinds of contact data were exposed, or when the incident took place. It also did not identify the other Amplitude customers caught up in the vendor's security incident, leaving open basic questions about the episode's scope. Those notifications are the main announced channel through which more detail on the incident's scope could emerge, and the reference to “other Amplitude customers” underlined how a single compromise at a shared analytics provider can touch many businesses at once.

The 2025 data breach

In May 2025, Coinbase disclosed a far more serious incident. The company said cybercriminals had bribed overseas customer support agents to steal personal data belonging to less than 1% of its monthly transacting users. The exchange refused a $20 million ransom demand and instead offered a $20 million bounty for information leading to the attackers' arrest.

A later filing with the Maine attorney general put the number of affected customers at 69,461, with exposed data including names, addresses, masked Social Security numbers and government ID images. The two incidents reached customer data through different channels — one via support agents, the other via an analytics vendor.

Data exposed through partners

Crypto firms have repeatedly seen customer data exposed through third-party partners — analytics vendors, shipping providers and others outside the exchanges' own systems. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk had exposed the names, phone numbers and home addresses of 67,000 U.S. customers, on top of nearly 14,000 it had disclosed in August. Some of the records dated back to 2019, years after ShipMonk had told Trezor they were deleted. Trezor warned affected customers to watch for fake emails, calls and letters, and about risks to their physical security.

At the time, cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals “we can locate you,” and that stolen data stays useful for years because people rarely move or change their numbers. That dynamic explains why contact-data disclosures like Coinbase's draw close attention even when funds are untouched: names, phone numbers and home addresses are the raw material for exactly the kind of fake emails, calls and letters Trezor warned about.

Source: Decrypt