Coinbase Says Amplitude Vendor Incident Exposed Contact Data, Not Funds
Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a small subset of its customers, and that its own systems were not accessed and customer funds were not affected. The exchange has not disclosed how many customers were affected or which data fields were exposed.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Coinbase Disclosed
Coinbase said a security incident at Amplitude, a third-party analytics provider, affected contact data for a "small subset" of its customers. The exchange said in a post on its support account on Tuesday that it had not suffered a data breach and that it had found no evidence of unauthorized access to its own systems.
Coinbase said customer funds were "not impacted" and that it is notifying affected customers and regulators in line with its legal obligations. The company did not say how many customers were affected, what contact data was exposed, when the incident occurred, or which other Amplitude customers were involved.
How the Earlier Coinbase Incident Compares
The new disclosure is separate from a larger incident Coinbase reported in May 2025, when it said cybercriminals had bribed overseas customer support agents to steal personal data of less than 1% of its monthly transacting users. Coinbase refused a $20 million ransom demand and offered a $20 million bounty for information leading to arrests. A later filing with the Maine attorney general put the number of affected customers at 69,461 and listed names, addresses, masked Social Security numbers and government ID images among the exposed data.
The two disclosures differ in scope and data type. Coinbase has not put a figure on the Amplitude exposure, so readers should not treat it as comparable in size to the 2025 incident.
Analysts Separate Custody Risk From Data Risk
Decrypt reported that cybercrime consultant David Sehyeon Baek said stolen names and home addresses remain useful to attackers for years because people rarely move or change phone numbers. NewsBTC argued that exposed contact details can enable impersonation, fake support contact and account-recovery scams even when no funds are taken. Both sources point to the same practical step: users should verify any contact from Coinbase through bookmarked official channels and should not share authentication codes or recovery phrases with anyone who reaches out.
The pattern of third-party exposure is not limited to Coinbase. Decrypt reported that hardware wallet maker Trezor disclosed in September that a breach at shipping provider ShipMonk exposed data on 67,000 U.S. customers, following nearly 14,000 records disclosed in August, with some records dating to 2019.
Open Questions
The sources do not agree on how much of the picture is known. Decrypt's coverage relies on Coinbase's own statements and does not add a customer count, while NewsBTC's analysis is general and does not add new facts about the incident. Neither source has independent confirmation of the scope of the Amplitude exposure. Coinbase has said it will provide more detail on affected fields, and that detail has not yet been published.
Why It Matters
For Traders
Coinbase says customer funds were not affected, so the immediate trading impact is limited, but users should be alert to phishing attempts using contact details.
For Investors
The incident highlights supply-chain data risk at exchanges, which may draw closer regulatory and vendor-oversight scrutiny over coming quarters.
For Builders
Teams sharing user contact data with analytics vendors should review data minimization, retention limits and vendor audit rights.
This article is for information only and is not financial advice. Read the full disclaimer.
