Coinbase has disclosed that a security incident at third-party analytics provider Amplitude exposed contact data belonging to a "small subset" of its customers. The exchange emphasized that its own systems were not compromised and that customer funds were not affected.
In a statement posted on X (formerly Twitter) by its support account, Coinbase said: "Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers." The company added that it had found no evidence of unauthorized access to Coinbase systems and that customer funds were "not impacted."
Coinbase said it is notifying affected customers and regulators in accordance with its legal obligations. However, the company did not specify how many customers were affected, what types of contact data were exposed, or when the incident occurred. It also did not identify the other Amplitude customers impacted.
Prior Breach in 2025
The Amplitude incident comes 17 months after Coinbase disclosed a more severe breach in May 2025, when cybercriminals bribed overseas customer support agents to steal personal data belonging to less than 1% of its monthly transacting users. The exchange refused a $20 million ransom demand and instead offered a $20 million bounty for information leading to the attackers' arrest.
A later filing with the Maine attorney general put the number of affected customers at 69,461, with exposed data including names, addresses, masked Social Security numbers, and government ID images.
Third-Party Risks Persist
Crypto firms have repeatedly seen customer data exposed through partners. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk had exposed the names, phone numbers, and home addresses of 67,000 U.S. customers, in addition to nearly 14,000 disclosed in August. Some records dated back to 2019, years after ShipMonk had told Trezor they were deleted. Trezor warned affected customers to watch for fake emails, calls, and letters, and about risks to their physical security.
At the time, cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals "we can locate you," and that stolen data remains useful for years because people rarely move or change their phone numbers.
