Coinbase attributes contact data exposure to vendor Amplitude incident
Coinbase attributes the exposure of customer contact data to a security incident at analytics vendor Amplitude. The company denies a breach of its own systems and says no funds were touched. The estimate of more than 70,000 affected customers comes from SlowMist's security chief; Coinbase has not released an official count.
What happened
Coinbase customer contact data was exposed through a security incident at Amplitude, its analytics vendor, which also affected other Amplitude customers. Coinbase denies a breach of its own systems and says customer funds were not affected. The estimate of more than 70,000 users comes from SlowMist's security chief; Coinbase has released no official number.
Why it matters
No source indicates passwords, private keys or funds compromised, but exposed contact data feeds phishing, SIM swapping and social engineering against customers. Coinbase is notifying customers and regulatory agencies under its legal obligations. The case exposes the risk of third-party vendors handling customer data.
What to do
Wait for Coinbase's official notification if you are an impacted customer; companies should review what customer data analytics vendors hold and who is liable in a leak. Remind customers that Coinbase support never asks for passwords, 2FA codes or recovery phrases; use hardware keys or passkeys, anti-phishing codes and withdrawal address whitelisting.
For the technical team
- Affected
- Coinbase Contas de clientes da Coinbase; informações de contato de mais de 70 mil usuários, segundo publicação no X · Coinbase customers whose contact data was held by Amplitude; Coinbase has disclosed no official count. SlowMist's security chief claims more than 70,000 users.
- Exploitation
- No technical exploitation, PoC or named threat actor; no dataset or sample has been published. DailyDarkWeb notes the 70,000 figure closely matches Coinbase's disclosed May 2025 insider incident, in which bribed support agents exposed data on 69,461 users, and treats the current claim as unverified, without ruling out a resurfacing of that case.
- Fix
- No software fix applicable; Coinbase is notifying impacted customers and regulatory agencies in accordance with its legal obligations.
- Vector
- Supply chain data exposure: a security incident at Amplitude, an analytics vendor, impacted a small subset of Coinbase customer contact data, among other Amplitude customers. Coinbase reports no evidence of unauthorized access to its own systems.
- More details
- CZ of Binance listed the case among four leaks reported the same day, alongside Bithumb, Mirae Asset and Daishin Securities. Defenses suggested by CZ: unique email alias per service, dedicated phone number, authenticator app or hardware keys instead of SMS 2FA, withdrawal address whitelisting and withdrawal time lock, anti-phishing code, carrier port-out PIN, and regular review of sessions and API keys. Leaked contact data is mostly used for phishing, SIM swapping and social engineering.
Timeline
Coinbase confirms the Amplitude vendor incident, denies a breach of its own systems and says funds were untouched; no official count of affected customers has been released.
Coinbase says there is no evidence of unauthorized access to its own systems, attributes the exposure to an incident at analytics vendor Amplitude, and states customer funds are unaffected while impacted customers are notified.
Binance's Changpeng Zhao cited the case among the day's leaks and stressed that customer funds were unaffected.
Want the next updates in your inbox? Get the daily edition →
See all 6 updates
Posts in crypto and security circles cite a researcher calling the case confirmed; no dataset, sample, or threat actor has been named, and there is no sign passwords, private keys, or funds were affected.
Coinbase denies a breach of its systems and attributes the contact data exposure to an incident at analytics vendor Amplitude; customer funds were not impacted.
First claim: post on X says the Coinbase breach is real, with contact info for more than 70,000 users accessed.
Sources 6 sources
- @DelCrxpto @DelCrxpto
- @CoinbaseSupport @CoinbaseSupport
- @DailyDarkWeb @DailyDarkWeb
- @cz_binance @cz_binance
- @coinbureau @coinbureau
See all 6 sources
- @IntCyberDigest @IntCyberDigest
