Coinbase Points to Analytics Vendor Amplitude After Customer Contact Data Is Exposed in Third-Party Incident
Coinbase Points to Analytics Vendor Amplitude After Customer Contact Data Is Exposed in Third-Party Incident #
Coinbase has disclosed that a security incident at analytics provider Amplitude exposed contact information belonging to a portion of its customers, while stating that the exchange itself was not the source of the breach.
The exchange’s support account posted on X that Amplitude “experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.” Coinbase said it found no evidence of unauthorised access to its own systems and confirmed that customer funds were unaffected. The company added that it is notifying impacted customers and relevant regulatory agencies as required by its legal obligations.
Coinbase did not publicly disclose the number of customers involved, the specific types of contact data exposed, or when the incident took place. Reports have pointed to email addresses and phone numbers as the most likely data fields affected. A filing with Maine’s attorney general, cited by Unchained Crypto, listed 69,461 users, while SlowMist security researcher 23pds reportedly put the figure at more than 70,000, a claim Coinbase has not confirmed. Neither Coinbase nor Amplitude responded to requests for comment from multiple outlets at the time of publication, and no statement appeared on Amplitude’s own blog.
Exposed contact details, even without passwords or financial information, are a common starting point for phishing campaigns and social engineering attacks targeting crypto users. The distinction Coinbase drew between a vendor-side exposure and a breach of its own infrastructure carries weight from a liability standpoint, though regulators and affected customers may assess it differently.
The incident comes roughly seventeen months after Coinbase disclosed a more damaging breach involving bribed overseas customer-support agents, which the company estimated would cost up to $400 million in reimbursement and remediation. That breach, disclosed in May 2025, affected less than one percent of the exchange’s monthly transacting users. The repeated exposure of customer data, including through third-party vendors, is likely to draw renewed scrutiny of how Coinbase manages the information it shares externally.
Copy link