Coinbase has denied reports of a new data breach after a security incident at third-party analytics provider Amplitude exposed the contact information of a limited number of its customers, stressing that its own systems were never compromised.

The exchange addressed the reports on October 28 in a statement shared through its Coinbase Support account on X, stating that its internal systems had not been compromised and that customer funds remained unaffected. The exposed data consisted of information processed by Amplitude, a vendor that also handles analytics data for other companies.

The company's response followed the circulation of alleged Coinbase breach notifications on social media, including unverified claims that more than 70,000 users had been affected and that some customers had lost cryptocurrency. Coinbase has not confirmed those figures and has reported no asset losses connected to the vendor incident.

A Vendor Exposure, Not an Exchange Breach

According to the exchange, the incident affected a small subset of Coinbase customer contact information, potentially including email addresses and telephone numbers. Coinbase identified Amplitude, an external analytics provider, as the source of the exposure rather than its own trading, custody, or account-management infrastructure.

The company said it has found no evidence of unauthorized access to its internal systems and maintains that customer assets remain secure. It is notifying affected customers and relevant regulators in accordance with applicable legal requirements, though it has not disclosed how many individuals are involved, the precise timeline of the intrusion, or the method used to access Amplitude's systems. The episode underscores how data entrusted to outside service providers can be exposed independently of a company's own infrastructure — a recurring dynamic in recent cryptocurrency-sector incidents involving vendors and partners.

Coinbase also confirmed that information belonging to other Amplitude customers was affected, indicating that the incident extended beyond its own data. Even without a direct breach of the exchange, exposed contact information carries privacy implications, as it can be used to target cryptocurrency holders through impersonation attempts.

The 70,000 Figure Tied to an Earlier, Separate Breach

Social media posts circulating alongside the latest incident referenced approximately 70,000 affected Coinbase customers — a figure associated with an earlier and separate security breach. In May 2025, Coinbase disclosed that criminals had bribed overseas customer support personnel to obtain account information for use in social-engineering attacks. A subsequent regulatory notification identified 69,461 affected individuals.

That 2025 incident prompted a $20 million ransom demand, which Coinbase refused, along with substantial remediation and reimbursement costs. It also triggered security concerns across rival exchanges, including attempted employee recruitment schemes targeting Binance and Kraken.

The October 2026 Amplitude incident is distinct from the 2025 insider case. Coinbase has not established a connection between the two events, nor has it confirmed that the earlier customer count applies to the latest exposure. The resurfacing of the old figure alongside the new incident shows how numbers from past breaches can circulate during fresh security events and cloud the picture before official details are confirmed.

Phishing Risks From Exposed Contact Data

Exposed contact details can allow criminals to construct convincing phishing emails, fraudulent security alerts, and telephone impersonation attempts. Attackers may exploit legitimate breach notifications to persuade customers to reveal passwords, disclose two-factor authentication codes, or transfer cryptocurrency to addresses presented as secure accounts.

The incident follows a series of customer-data breaches affecting cryptocurrency wallet providers throughout 2026. In January, Ledger customers faced targeted phishing attacks after a breach at e-commerce partner Global-e exposed personal and order information. SafePal disclosed an order-tracking vulnerability in August that exposed data belonging to 39,798 customers, while a Trezor shipping partner breach affected more than 80,000 buyers.

Most recently, Keystone suffered a data breach in October that exposed customer names, addresses, and purchase records through its online store, while Foundation Passport users were targeted by fake wallet-recall phishing emails. Although the incidents involved different systems and attack methods, the stolen information can enable highly targeted phishing and impersonation attempts against cryptocurrency holders.

Coinbase's Guidance to Customers

Coinbase advises customers to access its services directly rather than follow unexpected links or instructions from unsolicited messages. The exchange does not ask users to disclose recovery phrases, authentication codes, or passwords to customer support representatives. Customers who receive suspicious communications can verify their account status through the official Coinbase application or support website.

Customer notifications and regulatory reporting related to the Amplitude incident are continuing. The number of affected customers and the full categories of exposed information have not yet been publicly established, making official disclosures from Coinbase and regulatory filings the key details to watch as the incident's full scope comes into view.

Source: Crypto Adventure