Quick answer: The Coinbase Amplitude breach exposed contact data for a small subset of Coinbase customers through analytics vendor Amplitude, Coinbase said on Oct. 27, 2026. The exchange says its own systems were not accessed and funds are safe, but it has not said how many users were hit.
The Coinbase Amplitude breach exposed contact details for a small subset of Coinbase customers, but no funds were touched. Coinbase said late on Oct. 27, 2026 that the leak happened at Amplitude, a third-party analytics vendor, and not inside its own systems.
The news landed on a busy day for security teams. In South Korea, exchange Bithumb and two investment firms also reported cyber incidents. So the story is less about one exchange and more about how far customer data travels.
What happened in the Coinbase Amplitude breach?
Coinbase Support posted the statement on X on Tuesday night. “Coinbase has not had a data breach,” it said, as quoted by Decrypt. “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
The exchange added that it found no evidence of unauthorized access to its own systems. It is emailing affected users and informing regulators, as the law requires, CoinDesk reported.
However, several key facts are still missing. Coinbase has not said how many customers were affected. It also has not said which contact fields leaked, or when the incident took place. Cointelegraph asked for the number of affected users and had no reply at publication.
Why the Coinbase Amplitude breach still matters
Amplitude is a product analytics tool. Apps use services like it to track how people move through screens and features. To do that, a company often shares some user identifiers with the vendor. As a result, a breach at the vendor can expose data even when the exchange itself stays secure.
This is what security teams call supply-chain risk. Your funds may sit behind strong controls, while your email or phone number sits in a partner’s database. In our view, the “not our breach” framing is accurate but incomplete for users. From a customer’s side, the data still left the building.
Contact data alone cannot move coins. Even so, it is the raw material for phishing. A scammer who knows you use Coinbase can send a convincing fake alert or call pretending to be support. That is exactly how many past exchange scams worked.
Data and context: a pattern of third-party leaks
Coinbase has been here before, on a larger scale. In May 2025 it disclosed that criminals bribed overseas support agents to steal customer data. A later filing with the Maine attorney general put the count at 69,461 customers, according to Decrypt. Names, addresses, masked Social Security numbers and ID images were exposed. Coinbase estimated costs of up to $400 million, per Cointelegraph.
Other crypto firms face the same problem through partners. Hardware wallet maker Trezor said in September that a breach at shipping provider ShipMonk exposed data for 67,000 U.S. customers. That came on top of nearly 14,000 it had disclosed in August, Decrypt noted.
Meanwhile, the Korean incidents show the wider wave. CoinDesk reported that Bithumb found an intrusion in an employee system on Oct. 27. The exchange said customer crypto cannot be reached through that system. Daishin Securities said data for 38,490 customers leaked in an outside attack.
Markets shrugged off the news. Bitcoin traded at $81,473 at 10:52 UTC on Oct. 28, 2026, up 2.0% in 24 hours, per CoinGecko. Ether stood at $2,368, up 2.3%.
How to protect yourself after the breach
First, treat any unexpected message about your Coinbase account with suspicion. Coinbase support will never ask for your password, two-factor codes or seed phrase. Second, open the app or type the website address yourself instead of clicking links. Third, switch to an authenticator app or security key if you still use SMS codes. Also, consider a separate email address for exchange accounts.
Phishing waves often follow leaks like this one. We covered a similar case in our report on Foundation Passport phishing emails. For a recent example of how fast wallets can be drained, see the Bloom trading bot wallet drain.
Spending crypto through a card adds another layer to manage. If you use one, our crypto card comparison explains how the main options handle security and fees.
What to watch next
Watch for three updates. One is a count of affected users, which may appear in state breach filings. Another is a statement from Amplitude naming the scope and timing of the incident. The last is whether other crypto firms that use Amplitude confirm exposure.
In Korea, the Financial Supervisory Service is reviewing Bithumb, Daishin and Mirae Asset. Its findings could show whether the attacks were linked.
Coinbase Amplitude breach FAQ
Were Coinbase customer funds stolen?
No. Coinbase said on Oct. 27, 2026 that customer funds were not affected and that it found no evidence of unauthorized access to its own systems. The leak involved contact data held by analytics vendor Amplitude.
How many Coinbase users were affected?
Coinbase has not disclosed a number. It described the group as a “small subset” of customers and said it is notifying affected users by email and informing regulators.
What should Coinbase users do now?
Ignore unexpected calls, texts or emails that claim to be from Coinbase, and never share passwords, two-factor codes or seed phrases. Use an authenticator app or security key, and reach Coinbase only through its official app or website.
Sources
- Decrypt: Coinbase customer data hit in analytics vendor breach, funds “not impacted”
- CoinDesk: Coinbase says user funds are safe after third-party vendor exposes customer contact info
- Cointelegraph: Coinbase denies systems breach, says vendor exposed customer data
- CoinDesk: Bithumb hacked through employee system as South Korean financial firms face cyberattacks
- CoinGecko: Bitcoin price
This article is for information only and is not financial advice. Always do your own research.
