The first line of Coinbase’s statement was a denial: “Coinbase has not had a data breach.” The exchange’s support account posted it in a tweet on Tuesday night, then explained that a breach at another company had still caught some of its customers’ information.
That company is Amplitude, an analytics vendor Coinbase works with. Coinbase says a security incident at Amplitude affected contact data for a “small subset” of its users.
“Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers,” the Coinbase Support account wrote in the post, dated October 28, 2026.
What Coinbase disclosed, and what it didn’t
According to the exchange, there’s no evidence anyone got unauthorized access to Coinbase’s own systems. It said customer funds were “not impacted” and that it is notifying affected users and regulators, as the law requires.
Several details are missing. Coinbase gave no count of affected customers and didn’t list which types of contact data were exposed. The post also left out when the incident took place and which other Amplitude clients were hit.
Coinbase users who want to know if they’re in the affected group will need to wait for a notification.
Coinbase has dealt with a worse leak before
In May 2025, the exchange disclosed a much more serious incident. Cybercriminals paid off overseas customer support agents to steal personal data from less than 1% of its monthly transacting users.
The attackers demanded a $20 million ransom, and Coinbase refused to pay. It put up a $20 million bounty for information leading to their arrest.
A filing with the Maine attorney general later set the number of affected customers at 69,461. Names, addresses, masked Social Security numbers and government ID images were among the exposed data.
Vendor breaches keep hitting crypto users
Other crypto firms have been burned by their partners too. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk exposed the names, phone numbers and home addresses of 67,000 U.S. customers. That was in addition to nearly 14,000 it had disclosed in August.
Some of the leaked records dated back to 2019, years after ShipMonk had told Trezor they’d been deleted. Trezor told affected customers to look out for fake emails, calls and letters, and warned about risks to their physical security.
At the time, cybercrime consultant David Sehyeon Baek said a letter showing someone’s name and home address sends the message “we can locate you.” He added that stolen data stays useful for years, since people rarely move or change their phone numbers.
That makes even “contact data” from an analytics vendor worth taking seriously. If Coinbase notifies you, expect phishing attempts that use your real name and personal details. Ignore any call, email or letter that asks you to move funds or confirm account information.