Coinbase Says It Was Not Hacked, but a Vendor Leak Exposed Customer Data: What the Amplitude Breach Means for Your Wallet

Coinbase is telling customers it was not hacked — but their data may have leaked anyway. The exchange disclosed that a security incident at Amplitude, a third-party analytics vendor, exposed contact data belonging to a “small subset” of Coinbase customers, marking the latest example of crypto users’ information escaping through a side door.

By Raj Patel | October 28, 2026

“Coinbase has not had a data breach,” the company’s support account stated on Tuesday night. “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.” The company said it found no evidence of unauthorized access to Coinbase’s own systems and that customer funds were “not impacted.”

What Actually Happened

According to Decrypt, Coinbase is notifying affected customers and regulators in line with its legal obligations. But the exchange did not say how many customers were affected, what kinds of contact data were exposed, or when the incident took place — and it did not name the other Amplitude customers caught up in the breach.

The pattern here is familiar: your exchange didn’t get robbed, but a company it does business with did. Amplitude is a data analytics provider — the kind of firm businesses use to understand how users behave inside their apps. That means Amplitude holds copies of customer information for many companies at once, which makes vendors like it a one-stop shop for attackers. Instead of breaching dozens of hardened targets one by one, a criminal can hit a single softer supplier and walk away with data from all of its clients at once.

The 2025 Breach That Still Stings

This is not Coinbase’s first data scare, and the timing — 17 months after a far more serious incident — explains why the company rushed to control the narrative. In May 2025, Coinbase disclosed that cybercriminals had bribed overseas customer support agents to steal personal data belonging to less than 1% of its monthly transacting users. The exchange refused a 20 million USD ransom demand and instead offered a 20 million USD bounty for information leading to the attackers’ arrest. A later filing with the Maine attorney general put the number of affected customers at 69,461, with names, addresses, masked Social Security numbers and government ID images exposed.

Compared to that, the Amplitude incident looks contained: contact data only, no evidence of system access, no funds touched. But contact data is exactly what phishers need to mount convincing attacks, and the company’s decision not to disclose the scale of the leak means customers have no way to know whether they are in the affected group.

A Industry-Wide Problem

Crypto firms have repeatedly seen customer data exposed through partners. In September, hardware wallet maker Trezor said a breach at shipping provider ShipMonk had exposed the names, phone numbers and home addresses of 67,000 U.S. customers, on top of nearly 14,000 it had disclosed in August — with some records dating back to 2019, long after ShipMonk had told Trezor they were deleted. Trezor warned affected customers to watch for fake emails, calls and letters, and about risks to their physical security.

The lesson is uncomfortable but simple: your security depends on the weakest company that has your data, not just the one you chose.

What This Means For You

• Expect targeted phishing. Attackers who know you have a Coinbase account can craft convincing emails and texts. Coinbase will never ask for your password, recovery phrase, or remote access to your device.
• Treat urgency as a red flag. “Verify your account now or lose access” is the classic hook. Slow down and go to the app directly, never through a link.
• Use hardware security. A hardware wallet for long-term holdings and an app-based authenticator for login keep funds out of reach even if your contact data leaks.
• Official notices come in-app. Coinbase said it is notifying affected customers through proper channels — anything else deserves suspicion.

The Verdict

Coinbase’s message — “no breach, funds safe” — appears accurate for now. But the incident is a reminder that in crypto, the danger often isn’t the exchange being robbed; it’s you being tricked afterward. Your Bitcoin holdings, trading near 80,000 USD according to CoinGecko, don’t need to be stolen if a phishing email can convince you to hand over the keys.

Watch for official notifications, assume any unexpected message is a scam until proven otherwise, and keep your recovery phrase offline. That trio beats any vendor’s security policy.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.