US cryptocurrency exchange Coinbase has denied suffering a direct data breach after reports emerged that customer information had been exposed, attributing the incident to a security failure at third-party analytics provider Amplitude.
In a statement issued on October 27, 2026, Coinbase said a security incident involving Amplitude affected contact information belonging to a limited subset of its customers, alongside data associated with other companies using the analytics service.
The exchange maintained that investigators had found no evidence of unauthorized access to Coinbase’s internal systems and that customer funds remained unaffected. The clarification followed reports attributed to blockchain security firm SlowMist, which suggested that information associated with more than 70,000 Coinbase users had been compromised.
Coinbase has not independently confirmed that figure or disclosed the exact number of affected customers.
The incident highlights the distinction between a breach of an exchange’s infrastructure and the exposure of customer information through external technology providers.
Amplitude Incident Exposes Customer Contact Information
According to Coinbase, the security incident originated at Amplitude, a third-party analytics platform used by businesses to understand customer interactions with digital products. The affected information reportedly included customer email addresses and telephone numbers, although Coinbase has not published a complete inventory of exposed data fields.
The company emphasized that the incident did not involve unauthorized access to its trading infrastructure, cryptocurrency wallets or customer assets.
Coinbase also said it was notifying affected customers and relevant regulatory authorities in accordance with applicable legal requirements. However, the exchange did not specify when the unauthorized access began, how the attackers obtained the information or whether the compromised data had been distributed further.
Amplitude had not provided a detailed public technical explanation in the reports reviewed. The reported exposure of more than 70,000 customer records remains an external estimate rather than a confirmed figure from Coinbase.
Even where financial credentials remain secure, leaked contact information can create significant risks for cryptocurrency users. Attackers may use verified email addresses and phone numbers to impersonate exchange representatives, distribute fraudulent security notifications or attempt account-recovery scams.
Such attacks can be particularly consequential in cryptocurrency markets because transactions are generally irreversible once confirmed on a blockchain. Coinbase has previously advised customers that legitimate support personnel will never request passwords, recovery phrases or two-factor authentication codes.
Incident Revives Scrutiny of Third-Party Security
The latest disclosure comes approximately 17 months after Coinbase revealed a separate customer information breach involving overseas support personnel. In May 2025, the exchange disclosed that criminals had bribed contractors and employees to obtain customer records and internal documentation.
That incident exposed information including names, addresses, identification records and account-related details, although passwords and private keys were not compromised. Coinbase estimated remediation expenses and voluntary customer reimbursements associated with the earlier breach at between $180 million and $400 million.
The company also rejected a $20 million extortion demand and offered a reward for information identifying the attackers. The October 2026 Amplitude incident is distinct from that earlier breach, involving a different reported point of compromise and a narrower set of exposed information.
Nevertheless, both incidents demonstrate how cryptocurrency exchanges can face information-security risks beyond their core custody infrastructure. Analytics platforms, customer support contractors and other external service providers may process sensitive information without directly controlling digital assets.
For Coinbase, the immediate priorities include determining the full scope of the Amplitude exposure, completing customer notifications and establishing whether additional protective measures are necessary. The company has not reported cryptocurrency losses associated with the latest incident.
Until further technical findings emerge, the confirmed position is that Coinbase’s own systems were not found to be compromised, while some customer contact information was exposed through an external provider.
