Coinbase Says Analytics Vendor Amplitude Exposed Customer Contact Data

Coinbase said a security incident at Amplitude, a third-party analytics provider, exposed contact data belonging to a small subset of its customers, and the exchange said its own systems were not accessed without authorization. Customer funds were not affected, the company said.

"Coinbase has not had a data breach," the company's support account wrote on X on the evening of Oct. 27, U.S. time. "Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers." The same post said the exchange found "no evidence of unauthorized access to Coinbase systems," according to Decrypt.

Coinbase is notifying affected customers and regulators in line with its legal obligations. The company did not say how many customers were affected, which kinds of contact data were exposed, when the incident occurred, or which other Amplitude customers were hit, the report said.

A Coinbase spokesperson gave Cointelegraph more detail on the types of data involved. The incident affected "contact and limited transaction data," the spokesperson said, and did not involve "home addresses or any other information that would allow someone to directly access your account or your funds." Cointelegraph published that comment in an update on Oct. 29. The spokesperson also said Coinbase is notifying affected customers directly and notifying regulators.

Amplitude published its own account of the incident on Oct. 28, and TokenPost summarized the vendor update on Oct. 30. Amplitude said its security team detected unauthorized access to a limited area of its internal systems on Sept. 28, contained and remediated the access, and contacted customers whose event data was affected. The update does not give a date for when the access began.

The affected event data belonged to less than 0.3% of Amplitude customer accounts overall, according to the vendor update as relayed by TokenPost. That figure does not show how many individual Coinbase customers were involved, or what portion of Amplitude's affected accounts was tied to Coinbase. Coinbase itself gave no affected-user count in its disclosure.

TokenPost timed Coinbase Support's post at 10:49 p.m. ET on Tuesday, and the exchange repeated in it that customer funds were unaffected and that it was notifying affected customers and regulators. The company did not specify which contact fields were involved in its own customers' records.

Cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals "we can locate you," and that stolen contact data stays useful for years because people rarely move or change their numbers. Trezor, for its part, warned affected ShipMonk-breach customers to watch for fake emails, calls and letters and about risks to their physical security.

The episode sits alongside other recent breaches at exchanges and brokers. In South Korea, Bithumb was investigating whether a breach of its internal work platform exposed customer information, while brokerage Daishin Securities reported a leak of personal and credit information belonging to 38,490 customers, Cointelegraph reported.

Crypto firms have repeatedly seen customer data leak through service providers rather than through their own servers. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk had exposed the names, phone numbers and home addresses of 67,000 U.S. customers, on top of nearly 14,000 it had disclosed in August, a pattern Decrypt documented alongside the Coinbase disclosure. Some of those records dated back to 2019, years after ShipMonk had told Trezor they were deleted.

This is not Coinbase's first exposure of customer data through a third party. In May 2025, the exchange disclosed that criminals had bribed overseas support staff to pass along user information, and it refused a $20 million extortion demand. A later filing with Maine's attorney general put the number of users to be notified at 69,461, with names, addresses, masked Social Security numbers and government ID images among the data exposed, the coverage of that filing shows.

Exposed email addresses and phone numbers can feed phishing and social-engineering attempts even when passwords, private keys and balances are untouched. Neither Coinbase's post nor the vendor update has said how many Coinbase customers received a notice, and the vendor update does not identify Coinbase among the affected accounts by name.