Coinbase’s Amplitude Oops: A Contact Leak, Not a Fund Drain

Coinbase said Wednesday that a security incident at analytics vendor Amplitude exposed contact data belonging to a “small subset” of its customers, while customer funds were “not impacted” and the exchange found no evidence of unauthorized access to its own systems. On X, Coinbase Support (@CoinbaseSupport) said in a Tuesday-night post dated October 28, 2026, “Coinbase has not had a data breach,” then wrote: “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”

Coinbase said it was notifying affected customers and regulators in line with its legal obligations. It did not disclose how many customers were affected, what kinds of contact data were exposed, when the incident took place, or the names of other Amplitude clients affected. Cointelegraph said it contacted Coinbase for the customer count but had not received a response by publication.

The disclosure added to Wednesday’s reports of cyberattacks affecting crypto exchanges and traditional financial firms. In South Korea, Bithumb is investigating whether a breach of its internal work platform exposed customer information, while brokerage Daishin Securities reported a leak of personal and credit information belonging to 38,490 customers.

Coinbase disclosed a separate data breach in May 2025 that affected less than 1% of its monthly transacting users after cybercriminals bribed overseas customer support agents to steal personal data. The exchange refused a $20 million ransom demand, offered a $20 million bounty for information leading to the attackers' arrest, and estimated reimbursement and remediation costs at up to $400 million. A later filing with the Maine attorney general put the number of affected customers at 69,461, with names, addresses, masked Social Security numbers and government ID images exposed.

Vendor-linked leaks have also affected crypto hardware customers. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk exposed the names, phone numbers and home addresses of 67,000 U.S. customers, on top of nearly 14,000 it had disclosed in August. Some records dated back to 2019, years after ShipMonk had told Trezor they were deleted. Trezor warned affected customers about fake emails, calls and letters and risks to their physical security. Cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals “we can locate you,” and that stolen data stays useful for years because people rarely move or change their numbers.