Coinbase discloses exposure of contact data belonging to a small share of customers at external provider
Key Facts
Coinbase said a security incident at analytics provider Amplitude exposed contact data belonging to a “small share” of its customers, as well as other customers of the provider. Cointelegraph, citing Coinbase Support, reported that the company found no evidence of unauthorized access to its systems and that customer funds were unaffected. According to the company, the incident involved contact data held by an external provider, with no evidence that Coinbase’s own systems were breached. The company did not specify how many customers were affected or when the incident occurred at Amplitude. It also did not disclose which fields were included in the leak, leaving the incident’s detailed scope undisclosed.
Coinbase did not confirm a figure for the number of people affected. CoinDesk CC pointed to an online post claiming that data belonging to more than 70,000 users had been affected, but provided no source for the claim, and Coinbase did not address the figure. The number therefore does not represent a total disclosed by the company, which described the scope as a small share of its customers without specifying a figure. The company also did not clarify whether the exposed data included email addresses, phone numbers or other fields. CoinDesk said details about the number of people and the fields remain unspecified, while noting that email addresses and phone numbers, if included in the data, could provide material for phishing and social engineering attempts.
As for next steps, Coinbase said it is notifying affected customers and regulators in compliance with its legal obligations. The company did not specify the notification channel or when it would be completed. The step comes as the number of customers, the fields exposed and the timing of the incident remain undisclosed. Coinbase warns in its security guidance about scammers impersonating support staff who may pressure users to transfer their funds. The company says support will not ask for a password, verification codes or an asset transfer; these guidelines, however, do not establish that fraud attempts linked to the Amplitude incident have occurred.
The current incident differs from the data incident Coinbase disclosed in 2025. In a filing with the Securities and Exchange Commission, the company said it received a message from a threat actor on 11 May 2025, and that the actor obtained information after paying contractors or employees in support roles outside the United States. The data in the earlier incident included names, addresses, phone numbers and email addresses, as well as images of government IDs and limited account data that included balance snapshots and transaction history. Coinbase then initially estimated remediation expenses and voluntary customer reimbursements at about 180 million to 400 million dollars. In the Amplitude incident, the company has not disclosed a detailed count of those affected or the types of data, and has provided no cost estimate.
Coinbase announced on 14 October 2026 that third-quarter results would be released on 29 October, after the market close, with a live question-and-answer session the same day at 2:00 p.m. Pacific time. The results date follows the company’s announcement that it is notifying affected customers and regulators, but Coinbase has not specified whether it will provide further details about the Amplitude incident during the session. In a broader context, CoinDesk noted that the incident coincided with disclosures by several financial companies in South Korea of customer data breaches, including Daishin Securities. The Coinbase statement cited in reports does not estimate the incident’s impact on the company’s business or quarterly results.