Coinbase is facing new security questions after a breach at third-party analytics provider Amplitude exposed customer contact information. The exchange maintains that its own systems and customer funds remain untouched, according to a statement from its Coinbase Support X account.
The disclosure followed allegations circulating on X that attackers had obtained contact details belonging to more than 70,000 Coinbase users. That figure, circulated by accounts including Delcrxpto and SlowMist security executive 23pds, remains unverified.
Coinbase Denies Direct Breach
Coinbase rejected suggestions that its infrastructure had been breached, drawing a firm distinction between compromised vendor data and unauthorized access to its trading platform. The exchange's X account stated:
“Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.”
The company has not disclosed how many customers were affected, what specific information was exposed, or how attackers gained access.
Third-Party Exposure Raises Phishing Concerns
Amplitude provides analytics technology that helps businesses measure customer engagement and interactions with digital products. Such arrangements can expose information outside a company’s primary infrastructure when a vendor experiences a security failure. Secondary accounts identified email addresses and telephone numbers as potentially compromised information, although Coinbase has not independently confirmed those specific fields.
No compromise of passwords, private keys, recovery phrases, or account balances has been reported. Nevertheless, exposed contact information can furnish scammers with material for targeted phishing campaigns, so-called wrench attacks, fraudulent customer-support calls and SIM-swap attempts. Criminals don’t necessarily need access to an exchange’s servers to impersonate its representatives and persuade customers to surrender credentials.
Coinbase said it is notifying affected customers and regulators as required.
Previous Contractor Breach Cost Coinbase Hundreds of Millions
The disclosure follows a substantially more damaging contractor-related incident uncovered in May 2025, when bribed customer-support personnel working for TaskUs improperly accessed sensitive information belonging to 69,461 Coinbase users. That episode involved personal identification records, financial information, and limited transaction histories.
Attackers demanded $20 million, which Coinbase refused to pay, while remediation expenses and related costs reached hundreds of millions of dollars. The latest incident appears considerably narrower, with no reported loss of customer assets or intrusion into Coinbase systems. Its timing also puts the exchange under scrutiny ahead of third-quarter earnings scheduled for Thursday, Oct. 29.
For now, Coinbase has offered assurances about its systems but little detail about the vendor intrusion itself. The unanswered question is how much customer information left Amplitude’s control, and who now possesses it.
