Coinbase wants you to know one thing first: “Coinbase has not had a data breach.” That’s how the exchange’s support account opened a tweet on Tuesday night, before it explained that someone else’s breach had swept up some of its customers’ information anyway.
The someone else is Amplitude, a third-party analytics vendor. According to Coinbase, a security incident there affected contact data belonging to a “small subset” of its customers.
“Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers,” the Coinbase Support account said in the October 28, 2026 post.
What Coinbase said, and what it left out
The exchange said it found no evidence of unauthorized access to its own systems. Customer funds were “not impacted,” it said, and it’s notifying affected customers and regulators as the law requires.
The gaps are just as telling. Coinbase didn’t say how many customers were affected or which kinds of contact data were exposed. It also didn’t say when the incident happened or which other Amplitude customers were caught up in it.
If you’re a Coinbase user, that means you’ll have to wait for a notification to know whether you’re in the affected group.
This isn’t Coinbase’s first data scare
The exchange disclosed a far worse incident in May 2025. Cybercriminals had bribed overseas customer support agents to steal personal data belonging to less than 1% of its monthly transacting users.
Coinbase refused the attackers’ $20 million ransom demand. It offered a $20 million bounty instead, for information leading to their arrest.
A later filing with the Maine attorney general put the number of affected customers at 69,461. The exposed data included names, addresses, masked Social Security numbers and government ID images.
Partners keep leaking crypto customers’ data
Coinbase is far from the only crypto company hurt by a vendor’s breach. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk had exposed the names, phone numbers and home addresses of 67,000 U.S. customers. That came on top of nearly 14,000 it had disclosed in August.
Some of those records went back to 2019, years after ShipMonk had told Trezor they were deleted. Trezor warned affected customers to watch for fake emails, calls and letters, and flagged risks to their physical security.
Cybercrime consultant David Sehyeon Baek said at the time that a letter carrying a name and home address signals “we can locate you.” Baek said stolen data stays useful for years, because people rarely move or change their numbers.
So even “contact data” from an analytics vendor is worth treating seriously. If Coinbase tells you you’re affected, expect phishing that uses your real name and details, and don’t trust any call, email or letter asking you to move funds or confirm account details.
