Coinbase denies data breach after Amplitude vendor incident

Coinbase says it was not breached. Some of its customers’ contact details got out anyway.

The exchange has formally pushed back on reports of a data breach. It traces the exposure of customer information to a security incident at Amplitude, a third-party analytics provider. That distinction matters to Coinbase. It may matter less to users whose phone numbers are now in someone else’s hands.

What happened at Amplitude

According to Coinbase, the incident took place at Amplitude on October 27-28, 2026. The exposed data was limited to contact details, specifically email addresses and phone numbers.

Coinbase described the affected group as a small subset of its customers. It also noted that other Amplitude clients had data exposed, so this was not a Coinbase-only problem.

Security firm SlowMist put a number on it. SlowMist reported that contact data belonging to over 70,000 Coinbase users may have been accessed by hackers.

Coinbase’s framing is narrower. The company said there is no evidence of unauthorized access to its internal systems. It added that sensitive information such as passwords and transaction histories was not compromised.

Coinbase has stressed that customer funds and assets remain safe.

Coinbase’s response

The exchange says it is notifying affected customers by email. It has also reported the incident to the appropriate regulatory authorities, as the law requires.

Alongside the reassurance came a warning. Coinbase urged users to watch for phishing and social engineering attempts that could follow the exposure of their contact information.

What this means for Coinbase and its users

For customers, the practical impact centers on fraud risk rather than direct financial loss. Anyone who receives a notification email from Coinbase should treat unexpected calls, texts, and messages claiming to be from the exchange with extra suspicion.

A sensible posture is to assume that any unsolicited outreach about an account problem could be an attempt to exploit the leak. Going directly to the official app or website, rather than following links or calling back numbers, removes most of the leverage a scammer gains from knowing your contact details.

Watch for a few things from here. One is whether Amplitude or Coinbase publishes a firmer count of affected users, and whether it lines up with SlowMist’s figure of over 70,000. Another is how regulators respond to Coinbase’s required filing. The third is whether a wave of targeted phishing aimed at Coinbase customers surfaces in the weeks after the October 27-28 incident.