Coinbase confirms data exposure after Amplitude breach, funds remain safe

Coinbase clarified that its internal systems remained uncompromised following a security incident at analytics provider Amplitude, which led to the exposure of contact information for a portion of its user base. The statement, published by Coinbase Support on October 28, responded to rumors circulating online suggesting a major hack at the cryptocurrency exchange.

Amplitude breach exposes user contact data

Amplitude, a San Francisco-based analytics firm that provides tracking and behavioral analytics for web and mobile apps, experienced a security breach that affected several clients, including Coinbase. According to Coinbase, the incident impacted contact information such as email addresses and phone numbers for over 70,000 users, although only a small subset of customers was directly impacted.

Mini dictionary: Amplitude, founded in 2012, is a software company specializing in product analytics, enabling businesses to track and understand user behavior through event data. Its services are used by major firms in the technology and finance sectors.

Coinbase confirmed that the breach did not affect any wallets, authentication layers, or custody infrastructure. Sensitive data such as passwords, private keys, KYC documents, and transaction histories were not compromised. The company stated that affected customers and regulators would be informed as necessary.

Nature and risks of exposed contact information

While only contact data was accessed, the exposure creates potential risks for phishing and social engineering attacks. Similar attacks have targeted customers at other cryptocurrency platforms, including Binance and Kraken, by exploiting leaked phone numbers and email addresses. Attackers have previously used such information for impersonation emails, fake support calls, and SIM-swapping fraud.

Coinbase stated, “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and funds remain secure.”

As part of its usual security precautions, Coinbase advised customers to remain vigilant against suspicious emails or messages and to use official channels for communication and authentication.

Vendor risk and ongoing responses

The incident highlights ongoing supply-chain risks for centralized exchanges relying on third-party analytics and technology providers. Companies like Coinbase use services from analytics firms such as Arkham, Nansen, and Glassnode to enhance product and compliance monitoring, though these external vendors may not always be visible in on-chain data.

With over 100 million verified users and acting as custodian for major spot Bitcoin ETFs, including BlackRock IBIT, Coinbase is subject to heightened regulatory and public scrutiny. Previous breaches at vendors like Twilio have shown that attacks at third-party partners can extend vulnerabilities for long periods, complicating incident resolution.

Exchanges are now evaluating how they share data with third parties, tightening oversight of vendors, and considering more anonymized data telemetry. The event has also triggered regulatory follow-up under US state regulations and the General Data Protection Regulation (GDPR), which require timely notification and could lead to audits of Amplitude’s practices.

Experts noted that beyond protecting private keys, maintaining user security now demands careful management of third-party relationships and increased awareness of phishing tactics.

Security recommendations for users

Coinbase reiterated that no customer funds were compromised and advised users to be skeptical of unsolicited communications. Best practices include verifying URLs, using official apps, and not responding to suspicious contacts, reinforcing that robust security extends beyond core platform infrastructure.