Coinbase confirms Amplitude vendor breach leaked user contact data. Coinbase blames a breach at analytics vendor Amplitude for leaked contact data, disputes a 70,000-user figure, and warns of phishing and SIM-swap risk. * Subject - Coinbase customer contact data exposure via third-party vendor Amplitude * What happened - Vendor security incident * Actor - Amplitude * Regulator - regulators * Jurisdiction - United States * Status - Coinbase disputes 70,000-user figure * Incident - October 27, 2026 * Disclosed - 2026-10-27 * Source - https://unchainedcrypto.com/coinbase-ties-customer-contact-data-exposure-to-vendor-amplitude-says-it-was-not-breached/ What happened. Coinbase told customers on the evening of October 27, 2026, U.S. time, that it had not suffered a data breach. The incident is best described as a vendor security incident, with Amplitude as the actor at the center of the exposure, and Coinbase notifying regulators in the United States as it disputes a widely circulated 70,000-user figure. The exchange's support account posted on X that "Coinbase has not had a data breach," attributing the exposure instead to a security incident at Amplitude, a third-party product-analytics provider, according to Unchained Crypto. The company said the Amplitude incident "impacted a small subset of Coinbase customer contact data, among other Amplitude customers." The distinction Coinbase is drawing - its servers versus a vendor's - matters for liability and headlines, but it matters much less to the people whose names, phone numbers and limited transaction details are now sitting somewhere outside Coinbase's control. Exposed contact information, even without passwords or private keys, is precisely the raw material that scammers use to run phishing campaigns, fake support calls, SIM-swap attempts and so-called wrench attacks, as Bitcoin.com News noted in its coverage of the disclosure. For an exchange with over 100 million registered users, per India Today, even a "small subset" can mean tens of thousands of real targets. ASOS Customers Receive Alleged Hacker Push Notification Threat Sky News reports on a breaking situation where ASOS app users received a push notification claiming hackers compromised the retailer's Snowflake data instance. The video is for consumers and security professionals tracki The facts, in order. * Around 8 p.m. ET, Oct. 27: An account called DelCrxpto posted that hackers had obtained contact details for more than 70,000 Coinbase users, without citing a source, per Unchained Crypto. * **About two hours later: * Evening of Oct. 27 (U.S. time): Coinbase's support account posted on X denying a breach of its own systems and attributing the exposure to Amplitude, per Unchained Crypto. * Following the post: A Coinbase spokesperson told reporters the exchange found "no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted." * Same statement: The spokesperson said contact and limited transaction data were affected, but "not home addresses, or any other information that would allow someone to directly access your account or your funds." * Same statement: The spokesperson called the 70,000-user figure "false" and said Coinbase believes the number may have originated with Grok, the AI chatbot on X, conflating this incident with Coinbase's separate May 2025 breach. Neither Coinbase's public post nor the spokesperson's later statement gave an actual count of affected users or specified when the Amplitude-side incident occurred, according to Unchained Crypto. That gap - no number, no date - is the part of the story that got lost in the back-and-forth over whether "breach" is the right word. Why a vendor incident is still a Coinbase problem. Amplitude provides product-analytics services that help companies understand user behavior across apps and websites, according to the Free Press Journal. Firms like Coinbase feed such vendors customer data - names, contact details, usage patterns - so that an incident on the vendor's side can expose information even when the client's own infrastructure stays fully secure. That is the mechanism at work here: Coinbase's systems were not touched, but data it shared with Amplitude for analytics purposes leaked anyway. This is not an isolated pattern. Cryptopolitan pointed to a near-identical case in August 2026, when hardware wallet maker SafePal disclosed an access-control vulnerability that exposed order data for around 39,798 customers. In both cases, the core product - custody, in SafePal's case; exchange accounts, in Coinbase's - stayed intact. What leaked was the metadata layer: who the customer is, how to reach them, and what they've recently done. That is enough for a scammer to sound credible on a phone call. The playbook is consistent: obtain a name, a phone number and a plausible detail about the victim's account, then call pretending to be support, a security team, or law enforcement. Who is affected, and the 70,000-user dispute. Coinbase has not said how many customers are affected by the Amplitude incident. It has only said the number does not match the 70,000 figure that spread on X before its statement went up. Tracing that figure's origin matters because it illustrates how fast unverified numbers can calcify into "fact" during a live disclosure: | Timestamp (Oct. 27, ET) | Source | Claim | | ~8:00 p.m. DelCrxpto | 70,000+ users' contact details stolen, no source cited | | ~9:30-10:00 p.m. 23pds (SlowMist CISO) | Breach "confirmed," 70,000+ users affected | | ~10:00 p.m. (evening) | Coinbase support account | No breach of Coinbase; Amplitude incident disclosed, no figure given | | After post | Coinbase spokesperson | 70,000 figure called "false"; possible Grok conflation with May 2025 case | Coinbase's theory is that the number traces back to Grok, the AI chatbot on X, mixing up this new Amplitude incident with Coinbase's separate May 2025 breach - the one where criminals bribed overseas support agents to copy customer records, including names, phone numbers, government ID images and transaction histories, affecting more than 69,000 users, per India Today. Whatever the true count, no compromise of passwords, private keys, recovery phrases or account balances has been reported in connection with the Amplitude incident, per Bitcoin.com News. That is the one point every account of this story agrees on, and it is the reason Coinbase can accurately say customer funds were not impacted while still having a real problem on its hands. Coinbase's response. A Coinbase spokesperson confirmed that contact and limited transaction data were impacted, but said the exposure did not include home addresses or "any other information that would allow someone to directly access your account or your funds." The company says it is notifying affected customers directly and informing regulators, per Unchained Crypto. Coinbase has not disclosed when the Amplitude-side incident actually occurred, how long the exposure lasted, or the precise number of customers affected - gaps the Free Press Journal also flagged in its reporting. The timing lands against a backdrop of rising scrutiny of third-party data handling across finance generally. The Free Press Journal noted that India's State Bank of India separately acknowledged a data breach affecting nearly 3,900 customer records earlier in October 2026 - an unrelated incident, but one that underscores how routine vendor and third-party exposures have become across the sector. Treat unsolicited calls, texts or emails claiming to be from Coinbase support with suspicion, especially any that reference your account activity or ask you to "verify" credentials or move funds. 2. Never share a seed phrase, recovery phrase or one-time passcode with anyone who contacts you first, regardless of how much account detail they appear to know. 3. Contact your mobile carrier about adding a SIM-swap PIN or lock, since leaked phone numbers are a known precursor to SIM-swap attacks aimed at intercepting two-factor codes. 4. Enable hardware-based two-factor authentication rather than SMS codes wherever Coinbase and other exchanges support it. 5. Watch for Coinbase's direct notification if you believe you may be affected, and verify any communication through Coinbase's official app or site rather than links in messages. Sources. Ask Cipher about this article Get AI-powered insights, related threats, and expert context - powered by CISO Brain

Coinbase denies platform intrusion as vendor data leak emerges. October 28, 2026 - By Bitcoin.com News - Original - Updated Coinbase denies any platform breach following a data leak from analytics vendor Amplitude, claiming customer funds are secure. Confidence: 70% Horizon: short-term Key numbers. * 70,000+ users potentially affected * No reported loss of customer assets * Previous breach cost hundreds of millions Market drivers (micro). * Increased scrutiny on Coinbase's security measures * Potential for phishing attacks using exposed contact information * Market reaction to Coinbase's upcoming earnings report Context (macro). * Growing concerns about third-party vendor security in crypto * Increased regulatory focus on data protection in the crypto sector Who wins / who loses. * Coinbase may lose user trust if security concerns persist. * Phishing scammers could benefit from exposed contact information. Scenarios. Base Coinbase successfully mitigates the impact of the data leak and maintains user trust. Alt Increased phishing attacks lead to significant user losses and damage to Coinbase's reputation. What to watch next. * Updates on the number of affected users from Coinbase * Regulatory responses to the incident * Market reaction to Coinbase's upcoming earnings report Full analysis. Coinbase is facing renewed scrutiny regarding its security protocols after a recent data leak involving its analytics vendor, Amplitude. The incident has raised concerns about the exposure of customer contact information, with unverified claims suggesting that over 70,000 users may be affected. However, Coinbase has firmly denied any unauthorized access to its own systems, stating that customer funds remain secure. Key details of the incident. On October 28, 2026, Coinbase acknowledged a security incident involving Amplitude, which processes customer information for the exchange. The company emphasized that while Amplitude experienced a breach, its own infrastructure has not been compromised. This distinction is crucial, as it separates the vendor's security failure from any direct threat to Coinbase's platform. Coinbase's support account on X confirmed the incident, stating, "Coinbase has not had a data breach. Amplitude experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers." The company is currently in the process of notifying affected customers and regulatory agencies as required by law. Potential risks and concerns. Despite Coinbase's assurances, the exposure of customer contact information poses risks for targeted phishing attacks. Scammers can use this data to impersonate Coinbase representatives, potentially leading to credential theft and other fraudulent activities. Notably, the incident does not involve the compromise of sensitive information such as passwords or private keys. This latest incident comes on the heels of a more damaging breach in May 2025, where customer-support personnel improperly accessed sensitive information belonging to nearly 70,000 users. Coinbase incurred substantial costs from that incident, raising questions about its third-party security protocols. Conclusion. As Coinbase prepares for its upcoming third-quarter earnings report, the company is under increased scrutiny regarding its security measures. While it maintains that its systems are secure, the unanswered questions surrounding the extent of the data leak and the potential for phishing attacks remain a concern for both the company and its users.

Coinbase says user funds are safe after third-party vendor exposes customer contact info. Coinbase says a breach at analytics provider Amplitude exposed contact information for a small subset of customers, with no unauthorized access to Coinbase systems detected. Up next. Published on 28 October 2026 AI This post was created with the assistance of artificial intelligence (AI). Before you order Offer from Amazon Get hardware and tech essentials delivered free with Prime * Fast, free delivery on millions of items * Prime Video, Amazon Music and more included * Member-only deals all year As an affiliate, One2crypto earn on qualifying purchases. Coinbase says customer funds remain safe after a breach at third-party analytics provider Amplitude exposed contact information for a small subset of its customers. The exchange says its systems have not detected unauthorized access and is notifying affected customers, but has not disclosed how many people were affected or which contact details were exposed. Coinbase said customer funds remain safe after a breach at third-party analytics provider Amplitude exposed contact information for a small subset of the exchange's customers. Coinbase said it had detected no unauthorized access to its own systems and was contacting affected customers, while warning that exposed details could be used in phishing or social-engineering attempts. Coinbase denied reports that the exchange itself had been hacked, distinguishing the incident from an intrusion into its core systems. The breach originated at Amplitude, an analytics provider that also serves other clients, according to a statement from Coinbase Support's X account. The exposed material included contact information for a "small subset" of Coinbase customers, alongside data related to other Amplitude clients. Coinbase said it was informing impacted customers by email as required by law. It also said its systems had not detected unauthorized access. The company's public statement did not specify the number of Coinbase customers involved or identify precisely which contact-data fields were exposed. The exchange's assurance about funds and system access does not mean the incident poses no risk: contact details can be used to make fraudulent messages more convincing. The report did not establish that passwords, private keys or account balances were exposed. It described the incident as involving contact information, and Coinbase's statement focused on the absence of detected unauthorized access to its systems and the safety of customer funds. Further details about the affected records were not available in the source report. At a glance update When: Reported October 27, 2026; Coinbase say... The development Coinbase attributed a limited customer contact-information exposure to a breach at its analytics vendor Amplitude and said its systems and customer funds remain safe. Crypto market snapshot Fear & Greed Index 51/100 - Neutral Bitcoin BTC $81,256 1.8% Ethereum ETH $2,359 2.1% Tether USDT $0.9988 0.0% BNB BNB $757.84 2.6% XRP XRP $1.32 1.7% USDC USDC $0.9993 0.0% Solana SOL $102.48 2.5% TRON TRX $0.3317 1.3% Live data · CoinGecko · alternative.me (24h change) How vendor breaches reach customers. The incident shows how a company's customers can face data-security risks through an outside provider, even when the company says its own infrastructure was not accessed. Third-party services can handle customer-related information as part of ordinary business operations, creating a separate point of exposure beyond an exchange's direct systems. For affected Coinbase customers, the immediate concern described in the report is not a confirmed loss of funds but the possibility of targeted contact. Someone with an email address or phone number may send a message that appears to come from Coinbase or another trusted service and try to obtain account credentials or other sensitive information. That phishing risk is distinct from a confirmed account compromise; the report did not say that attackers had accessed customer accounts. The distinction matters for readers evaluating the company's reassurance. Coinbase said funds were safe and no unauthorized access to its systems had been detected, but exposed contact details can still create risks that require attention from customers. The incident also puts the security practices of analytics and other service providers in focus, since a vendor breach may affect information handled across several client organizations.