Coinbase Limits Contact Data Exposure to Small Group of Customers
Key Facts
Coinbase said a security incident at Amplitude, an external analytics provider, exposed contact information belonging to a small group of its customers, along with data belonging to other customers of the provider. CoinDesk reported the details in a story published on October 27, 2026, and updated the same day. The company did not describe the incident as a breach of its systems, instead attributing its origin to the service provider. Coinbase said customer funds were unaffected and that it had detected no unauthorized access to its systems. This places the incident within the scope of contact information exposure, while details about its scale and the nature of the data remain undisclosed.
Coinbase did not specify how many customers were affected or which contact information fields were exposed. The company therefore did not confirm a figure for those affected or whether the leak included email addresses, phone numbers or other data. This disclosed scope differs from claims that tens of thousands of users were affected, as the company described it as limited to a small group. The lack of detail on the fields also makes it impossible to know how much of the information could be used to contact customers or impersonate the company. Coinbase said it was notifying affected customers by email as required by law.
Coinbase said its systems had recorded no unauthorized access and that customer funds remained safe. This means the disclosure focuses on contact information held by an external provider, rather than an announcement of access to customer accounts or the transfer of their assets. CoinDesk, meanwhile, noted that email addresses and phone numbers, if they were among the exposed data, could be used in phishing or social engineering attempts. The report did not specify which fields were involved, so these risks remained dependent on the nature of the potential data. Coinbase also said it was notifying those affected directly by email.
The company's earlier security guidance offers a practical illustration of the risks of support impersonation after contact information is exposed. Coinbase has said it does not call customers unsolicited, and that anyone asking them over the phone to transfer their assets is a scammer. This advice comes in the context of the possibility that contact data could be used to build seemingly credible communications; it is not evidence that fraud attempts linked to this incident have occurred. So far, the company has said only that it is notifying affected customers and has detected no unauthorized access to its systems. CoinDesk did not specify when further details about the incident would be announced.
The incident recalls a previous data breach at Coinbase in 2025, but differs in the details disclosed. In a filing with the U.S. Securities and Exchange Commission on May 15, 2025, the company said an attacker paid contractors or employees in support roles outside the United States to obtain information from its internal systems. Coinbase then initially estimated remediation expenses and voluntary customer reimbursements at between $180 million and $400 million, while the investigation continued and the full impact remained unclear. The company said in the filing that it was cooperating with law enforcement in the investigation. After that incident was announced, its shares fell 6% near midday trading on May 15, 2025, according to the Associated Press.
In more recent trading, Coinbase shares closed at $177.08 on October 21, 2026, then at $169.09 on October 22 and $164.45 on October 23. The close fell to $159.6 on October 26, before reaching $161.09 on October 27. These closing prices provide context for the stock's movement in the days before the details were announced, but do not establish that the incident caused any price move. CoinDesk published its report on the incident on October 27, according to the publication and update times cited in the report. The available information did not include a specific date for disclosing the number of people affected or details of the exposed fields.
The incident comes amid other separate security events in the digital asset sector. EL7 published a report on August 13, 2026, about a data breach targeting users of Trezor wallets, and another report on October 28 about a separate security breach and personal data leak at South Korea's Bithumb platform. The available information does not indicate a connection between these incidents or a shared source. In Coinbase's case, the company identified Amplitude as the source of the incident and said the exposed information concerned a small group of its customers. The next step announced remains notifying affected customers by email.