Coinbase said a security incident at analytics vendor Amplitude affected a small subset of customer contact data, while maintaining that its own systems were not breached and customer funds were not impacted.
The disclosure came after claims spread on X that attackers had obtained contact details for more than 70,000 Coinbase users. Coinbase has not confirmed that figure and said it is notifying affected customers and regulators in line with its legal obligations.
Vendor incident prompts new security questions
The company drew a clear line between an issue at a third-party provider and any compromise of its trading platform. In a statement posted on X, Coinbase said Amplitude experienced a security incident affecting some Coinbase customer contact data, along with data tied to other Amplitude clients.
Coinbase added that it has found no evidence of unauthorized access to its own systems. It also said customer funds were not affected by the incident.
Scope of exposure remains unclear
Coinbase has not disclosed how many customers were affected, what categories of data were exposed, or how the attackers gained access. The widely shared claim that more than 70,000 users were impacted remained unverified at the time of the report.
Secondary accounts on social media suggested that email addresses and phone numbers may have been exposed, but Coinbase has not independently confirmed those details. No compromise of passwords, private keys, recovery phrases, or account balances has been reported.
Why contact data can still create risk
Amplitude provides analytics tools used by companies to measure customer engagement and interactions with digital products. Incidents involving such vendors can expose information that sits outside a company’s core infrastructure, even when the company’s own servers are not accessed.
Even limited contact data can be valuable to criminals. Email addresses or phone numbers can be used in phishing attempts, fraudulent customer-support outreach, SIM-swap efforts, or other targeted scams designed to trick users into giving up credentials or access.
Incident follows a larger Coinbase data event
The latest disclosure arrives after a much more serious contractor-related episode uncovered in May 2025. In that case, bribed customer-support personnel working for Taskus improperly accessed sensitive information tied to 69,461 Coinbase users.
That earlier incident involved personal identification records, financial information, and limited transaction histories. Attackers demanded $20 million, which Coinbase declined to pay, and the fallout led to remediation and related costs that reached hundreds of millions of dollars, according to the report.
By contrast, the current Amplitude-related incident appears narrower, with no reported loss of customer assets and no reported intrusion into Coinbase systems.
What happens next
For now, Coinbase has offered assurances about the state of its platform but few specifics about the vendor incident itself. The key unresolved questions are how much customer information was exposed through Amplitude and who may now have access to it.
The company said it is contacting affected customers and relevant regulators. The disclosure also puts Coinbase under added scrutiny ahead of its third-quarter earnings, scheduled for Thursday, Oct. 29.
Source: news.bitcoin.com