Coinbase Data Breach: Exchange Says Its Systems Were Not Compromised After Amplitude Vendor Leak

More than 70,000 Coinbase customers may have had their contact information exposed on October 28, 2026 — but not through a breach of the exchange itself. Coinbase’s support account said a security incident at Amplitude, a third-party analytics vendor, exposed a “small subset” of Coinbase customer contact data, and that Coinbase’s own systems were never compromised.

The clarification landed roughly half an hour after a security researcher described the event as a confirmed Coinbase data breach. The distance between the two statements is the story: the exchange frames the event as a vendor-side leak, while the researcher’s figure of more than 70,000 affected users remains unconfirmed by Coinbase.

In its statement, Coinbase Support named the vendor directly: “Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”

What Coinbase Confirmed and What It Left Out

Coinbase’s account rests on three specific assertions. The incident happened at Amplitude, not at Coinbase. Coinbase found no evidence of unauthorized access to its own internal systems. And customer funds were not affected.

The exchange added that it is notifying affected users and the relevant regulatory authorities in line with legal requirements. What the statement did not include is equally revealing: no count of affected users, no list of which contact fields were exposed, and no date for the Amplitude incident itself.

Amplitude is a product-analytics platform that companies use to track how users move through their apps and websites. Because it sits inside a customer’s product experience, its systems can hold identifiers such as email addresses and phone numbers for the companies it serves. That is why a failure at Amplitude can touch Coinbase customer data without Coinbase’s own databases ever being accessed.

That omission matters because the phrase “small subset” is doing the heavy lifting. Without a denominator, it cannot be checked against anything. A small subset of a very large user base can still be tens of thousands of people.

Where the 70,000 Figure Comes From

The number that circulated ahead of Coinbase’s response came from the chief information security officer at blockchain security firm SlowMist, who posts under the handle 23pds. He wrote that the breach was confirmed and that hackers had obtained contact information for more than 70,000 users.

His post also said it was not immediately confirmed whether passwords or funds were stolen. Coinbase has not adopted the 70,000 figure, and as of October 29 it had not published a count of its own.

The result is a gap a careful reader should hold onto: a claim of 70,000-plus affected users from a security researcher, set against an exchange that calls the same event a small subset and attaches no number. Both statements can be true. Neither has been reconciled.

A Busy Week for Crypto and Financial Data Breaches

The Amplitude incident did not happen in isolation. On October 27, South Korea’s second-largest exchange, Bithumb, confirmed that an outside party accessed its internal mobile groupware system and leaked personal data. The country’s Financial Supervisory Service is investigating that case alongside intrusions at Mirae Asset Global Investments and Daishin Securities.

Daishin Securities disclosed a concrete figure of its own: personal and credit information on 38,490 customers was leaked. If SlowMist’s 70,000 figure for the Coinbase vendor leak is accurate, the exposure would be roughly 1.8 times the size of the largest disclosure from the South Korean cases.

The pattern across these incidents is consistent. Attackers are targeting third-party vendors and internal collaboration tools rather than the customer-facing platforms themselves, which lets them obtain data without defeating a major exchange’s own defenses. For the exchange side of that trend, BlockchainReporter covered the Bithumb confirmation in detail here.

The timing compounds the concern. Three named financial institutions disclosed or confirmed intrusions within roughly 48 hours, and two of them — Bithumb and Daishin — did so on the same day. Investigators have not said whether the incidents are connected, but the clustering is enough to keep pressure on exchanges and the vendors they depend on.

What Coinbase Users Should Do

Coinbase has said customer funds were not affected and that it found no evidence its systems were accessed. On the facts available, there is no reason to believe account balances or credentials held by Coinbase were compromised.

The realistic risk is phishing. Exposed contact data — email addresses and phone numbers — is exactly what attackers use to send targeted messages that imitate Coinbase. A user who receives a text or email claiming to be from Coinbase should not click links inside it, and should log in only by typing coinbase.com directly rather than following an inbound link. Keeping two-factor authentication enabled and using a unique password on the account adds a second layer that contact data alone cannot bypass.

The incident is also a reminder of how quickly a vendor problem can be reported as an exchange hack. For a practical guide on separating real incidents from rumor, BlockchainReporter has a walkthrough on verifying crypto news.

Frequently Asked Questions