Coinbase Ties Contact-Data Exposure to Amplitude Incident

Coinbase said on October 28 that a security incident at Amplitude, a third-party analytics provider, exposed some customer contact information, but that customer funds and its own systems were not compromised. The exchange rejected suggestions that hackers had breached its internal infrastructure, according to Coincentral.

The Nasdaq-listed exchange said the exposed material was limited to a small portion of customer contact data held by Amplitude, including email addresses and phone numbers, and that other businesses using the provider were also affected. Coinbase said passwords, transaction histories and customer assets were not involved, and that its security checks found no signs of unauthorized access.

Key facts

• Coinbase dated the Amplitude incident to October 27–28, 2026, and said the exposure covered email addresses and phone numbers only.
• The exchange has not published a confirmed count of affected customers and described the group as a small subset.
• SlowMist circulated an unverified claim that contact data for more than 70,000 Coinbase users may have been accessed; Coinbase has not confirmed that figure.
• Coinbase Support said it is emailing affected customers and informing regulators as required by applicable laws.
• Cryptobriefing reported that Coinbase shares last closed at $161 on October 27, with a market capitalization of $42.5 billion.

Where the two accounts line up

Both outlets trace the exposure to Amplitude rather than to Coinbase’s own infrastructure. Coincentral reported that the incident also touched data linked to other businesses using the provider, while Cryptobriefing noted that the problem was not limited to Coinbase clients.

The outlets differ on the size of the affected group in one respect. Coincentral and Cryptobriefing both carried SlowMist’s figure of more than 70,000 users, and both noted that Coinbase has not confirmed it. Coincentral attributed the claim to a SlowMist security executive; Cryptobriefing described it as a SlowMist report. Neither exchange statement supplied a number, and Coinbase has not given a full breakdown of the data involved.

Other incidents reported this week

The Coinbase disclosure landed alongside several unrelated security cases. Cryptobriefing reported that Keystone, a hardware wallet maker, disclosed a breach on October 24 in which attackers obtained customer names, shipping details and order records through its website; private keys and payment information were not exposed.

Coincentral reported that phishing emails targeting Foundation Passport users emerged on October 26, after the hardware wallet maker tied the messages to compromised Cloudflare access keys. Foundation said its devices and customer funds remained safe.

In South Korea, Daishin Securities reported leaked data belonging to 38,490 customers on Wednesday, crypto exchange Bithumb investigated unauthorized access to an employee system, and the Financial Supervisory Service reviewed a separate incident at Mirae Asset Global Investments.

A separate breach on the Railway platform, which is unrelated to Coinbase, was linked by blockchain investigator Taylor Monahan to roughly $371,000 in cryptocurrency theft. Railway said unauthorized parties might have accessed customer system secrets.

Why it matters

For Coinbase customers, the practical risk is fraud rather than direct loss of assets: contact details are the raw material for phishing calls and messages that impersonate exchange support. Because the exposure came through a vendor, it also highlights how much customer data exchanges hand to outside analytics firms, and how a breach at one provider can surface across several companies at once.

The exchange has urged account holders to treat unsolicited outreach about account problems with suspicion and to verify notices through its official app or website rather than links or callback numbers.

What to watch

Two data points will shape the next phase: whether Amplitude or Coinbase publishes a firmer count of affected users that can be checked against SlowMist’s figure, and how regulators respond to Coinbase’s required filing. A wave of targeted phishing aimed at Coinbase customers in the weeks after the October 27–28 incident would also indicate how widely the contact data is circulating.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, Cryptobriefing