Coinbase Customer Data Exposed Through Analytics Vendor Amplitude: What We Know and How to Stay Safe

Coinbase says some of its customers' contact details were exposed, but not through a hack of Coinbase itself. On October 28, the exchange said the leak came from Amplitude, an analytics company it uses, and that customer funds and its own systems weren't affected. Here's what we know, what's still unclear, and how to protect yourself from the phishing that usually follows.

Last updated October 28, 2026. This is a developing story.

What happened

• A security incident at Amplitude, an analytics provider used by Coinbase and many other companies, exposed contact data for some Coinbase customers.
• Coinbase says it found no unauthorized access to its own systems and that customer funds were not affected.
• Coinbase calls the affected group a "small subset" of its customers. Other Amplitude clients were also hit.
• Coinbase says it's notifying affected customers and regulators as required by law.

What we still don't know

• How many people were affected. A security researcher (23pds of SlowMist) claimed it's over 70,000 users, but Coinbase hasn't confirmed that number. Be careful: "about 70,000" was also the size of Coinbase's separate 2025 breach, so some reports may be mixing the two up.
• Exactly which details leaked. Some reports mention emails and phone numbers; Coinbase's statement only says "contact data."
• How the attacker got in, and when the Amplitude incident started.

Not the same as the 2025 breach

In May 2025, Coinbase disclosed a different incident: bribed overseas support staff leaked data on roughly 69,000 customers, including names, addresses and ID images, and attackers demanded a $20 million ransom, which Coinbase refused to pay. This new incident is separate and, based on what Coinbase has said so far, involves contact data through a third-party vendor.

How to protect yourself

• Coinbase will never call you asking you to move funds, "secure" your account or share codes. Hang up, and contact Coinbase only through the app or the official website.
• Never share your 2FA codes, password or recovery phrase, with anyone, for any reason.
• Don't click links in emails or texts about your account. Open the Coinbase app yourself instead.
• Turn on a strong 2FA method such as an authenticator app or a security key, rather than SMS, if you haven't already.
• If you keep crypto long-term, consider a self-custody wallet, and keep its recovery phrase offline. (And if you use a hardware wallet, read our article on the Keystone breach from this week too.)

My take

Two big customer-data leaks in crypto in one week, Keystone and now Coinbase through a vendor, and the pattern is the same: the coins are safe, but your name and contact details end up on a list that scammers will use. Credit to Coinbase for saying quickly that funds and its systems are safe, but "a small subset" with no number isn't enough; users deserve to know if they're affected. Until then, treat every unexpected "support" message as fake. Have you had any suspicious Coinbase messages lately?