Coinbase Says Amplitude Incident Hit Customer Contact Data

Elena Vasquez

On October 28, 2026, Coinbase said an Amplitude incident hit contact data for a small subset of customers and found no evidence of unauthorized access to Coinbase systems. The company also said customer funds remained unaffected.

Coinbase Support wrote: “Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.” That categorical wording is broader than the evidence supplied.

Coinbase did not disclose how many customers were affected, what kinds of contact data were exposed, when the incident took place, or the other Amplitude customers involved. The available information establishes vendor-side exposure, but not its scale or duration.

What is Coinbase confirming?\n

The company said it is notifying affected customers and regulators in line with legal obligations. That process may establish who received which data and whether notification must extend beyond the subset described publicly; Coinbase gave no deadline for the process.

Coinbase’s statement that funds were unaffected addresses asset loss, not every consequence of contact-data exposure. Customers may still face impersonation attempts or targeted scams, although the company did not identify which fields create those risks.

A distinction remains important: no evidence of unauthorized access to Coinbase systems does not mean Amplitude did not hold exposed customer data. Coinbase also did not say whether affected customers should take a specific protective step.

In plain terms, Coinbase reports no system access, but the customer-data exposure remains unquantified.

How does this compare with the 2025 breach?

Coinbase disclosed a far more serious incident in May 2025, when cybercriminals bribed overseas customer support agents to steal personal data from fewer than one in every 100 monthly transacting users. The exchange refused a $20 million ransom demand and offered a $20 million bounty for information leading to the attackers’ arrest.

A later filing with the Maine attorney general placed the affected population at 69,461 customers. It listed:

• Names
• Addresses
• Masked Social Security numbers
• Government ID images

The breadth of those fields differs from the unspecified contact data in the Amplitude incident. One case involved bribed support agents; the source attributes the current incident to Amplitude and identifies no comparable tactic.

The Amplitude incident comes 17 months after the May 2025 disclosure. The source does not identify a common attacker, connect the episodes or repeat the bribery method. The timeline therefore shows recurring customer-data exposure, not a confirmed repeat breach.

In plain terms, the cases differ in scale and method, but both keep data handling on Coinbase’s compliance agenda.

Why can vendor exposure remain dangerous?

Across Coinbase and Trezor, crypto firms have repeatedly faced customer-data exposure through partners. The comparison illustrates a shared risk channel, not an operationally equivalent pair of incidents.

Trezor said a breach at shipping provider ShipMonk exposed data on 67,000 U.S. customers:

• Names
• Phone numbers
• Home addresses

It had disclosed nearly 14,000 additional customers in August. Some records dated to 2019, although ShipMonk had told Trezor that the data had been deleted.

Trezor warned affected customers about fake emails, calls and letters, as well as risks to physical security. Cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals “we can locate you.” He said stolen data stays useful for years because people rarely move or change their numbers.

That case does not establish which fields Amplitude exposed or prove that Coinbase customers received fraudulent communications. It does show why deletion assurances and incident dates require verification, because old contact details can support credible threats long after an operational failure.

In plain terms, vendor incidents can remain dangerous because stale contact details still enable convincing impersonation.

What remains unresolved?\n

Until Coinbase supplies those details, outsiders cannot determine how many people received notice, whether other Amplitude clients face overlapping exposure, or whether the company will revise customer-protection guidance. The statement on funds is narrower than the unanswered questions about identity risk.

The immediate enforcement window is Coinbase’s notification process for customers and regulators. Regulators can test whether the “small subset” description rests on a defined customer count, a field-level inventory and a clear incident timeline, although the source provides no public deadline for that review or any required remediation schedule.