Coinbase has formally denied that its own systems were breached, attributing the exposure of customer contact information to a security incident at Amplitude, a third-party analytics provider. The exchange said the incident occurred at Amplitude on October 27-28, 2026, and that the exposed data was limited to email addresses and phone numbers.
Coinbase described the affected group as a small subset of its customers and noted that other Amplitude clients also had data exposed, making the incident broader than a Coinbase-only problem.
Differing accounts of the scope
Security firm SlowMist reported that contact data belonging to more than 70,000 Coinbase users may have been accessed by hackers. Coinbase's characterization was narrower, saying only that a small subset of customers was affected.
The exchange said there is no evidence of unauthorized access to its internal systems, and that sensitive information such as passwords and transaction histories was not compromised. Coinbase also stressed that customer funds and assets remain safe.
Notifications and regulatory reporting
Coinbase said it is notifying affected customers by email and has reported the incident to the appropriate regulatory authorities as required by law.
Alongside its reassurances, the exchange warned users to watch for phishing and social engineering attempts that could follow the exposure of their contact information.
What customers should watch for
For affected users, the practical impact centers on fraud risk rather than direct financial loss. Customers who receive a notification email from Coinbase should treat unexpected calls, texts, and messages claiming to be from the exchange with added suspicion.
Security guidance suggests assuming that any unsolicited outreach about an account problem could be an attempt to exploit the leak. Going directly to the official app or website, rather than following links or calling back numbers, reduces the leverage a scammer gains from knowing a user's contact details.
Key questions going forward include whether Amplitude or Coinbase publishes a firmer count of affected users and whether it aligns with SlowMist's figure of over 70,000, how regulators respond to Coinbase's required filing, and whether a wave of targeted phishing aimed at Coinbase customers surfaces in the weeks after the October 27-28 incident.
