Coinbase said it found no evidence that its own systems were accessed without authorization after reports alleged that contact details for more than 70,000 users had been exposed through Amplitude, a third-party analytics provider. The exchange said customer funds were unaffected and that it would notify affected users and regulators where required.
The episode places fresh attention on the security risks created when cryptocurrency platforms share customer information with external software providers. Even where passwords, private keys and trading systems are not involved, names, email addresses and phone numbers can give criminals enough material to build convincing impersonation campaigns aimed at account holders.
Initial claims about the alleged incident were shared by DelCrxpto and SlowMist chief information security officer 23pds. Both said the reported exposure involved user contact data, while stressing that theft of passwords or funds had not been confirmed. Amplitude had not published a public statement about the reports as of Oct. 28, according to its public status page and company announcements.
Coinbase says funds and internal systems were unaffected
Coinbase’s response drew a line between a reported vendor-related data exposure and an intrusion into the exchange itself. The company said it had detected no unauthorized access to Coinbase systems, a distinction that limits the immediate evidence of risk to account balances and custody infrastructure.
That does not remove the potential danger for customers whose contact details may have been included. Fraudsters frequently use personal information to make phishing messages appear legitimate, posing as exchange security teams and directing targets to fake login pages or malicious transaction approvals.
Zhao Changpeng, the founder of Binance, wrote on X on Oct. 28 that four separate data-leak reports had emerged that day. He named the Coinbase-related Amplitude issue alongside reports involving South Korean exchange Bithumb and financial companies Mirae Asset and Daishin Securities. Zhao said data fields exposed in such incidents can include names, emails, telephone numbers, addresses, identification documents and transaction records, information that can support phishing, SIM-swapping and other social-engineering attacks.
Coinbase said it would contact impacted customers directly. Users receiving unexpected security messages should independently open the Coinbase app or type the company’s official web address into a browser rather than following links delivered by email or text.
Amplitude’s role is analytics, not crypto custody
Amplitude is a San Francisco-based product analytics company traded on Nasdaq under the ticker AMPL. Its software helps businesses track activity in websites and mobile apps, offering real-time analytics, session replay, A/B testing and tools designed to turn usage data into product and marketing decisions.
The company was built from internal analytics tools created by Spenser Skates and Curtis Liu after their earlier startup, Sonalight. Amplitude formally shifted toward product analytics in 2014, when Jeffrey Wang joined Skates and Liu as the company’s third co-founder. Skates remains chief executive.
Amplitude went public through a direct listing in September 2021. It reported roughly $343 million in fiscal 2025 revenue and employed about 750 to 800 people, according to the supplied company information. Its shares climbed from about $6.60 in late June to an intrayear high of $17.72 on Oct. 23.
Publicly documented Amplitude use cases in financial services and cryptocurrency have included Ramp Network and Xapo Bank. Those deployments focused on analyzing customer behavior and improving onboarding rather than managing private keys, wallets or custody systems. Public company materials also identify Dave, Salt Bank and several foreign-exchange and derivatives brokers as users of its tools.
The reported Coinbase matter follows a separate incident involving SpotAngels in September 2026. SpotAngels said that stolen credentials had allowed a third party to access some data stored in Amplitude, while maintaining that Amplitude’s platform itself had not been breached. The two events involve different circumstances, but both illustrate how access credentials and vendor-held data can create exposure beyond a company’s own network.
A sensitive backdrop for Coinbase customers
Coinbase has dealt with more serious customer-data incidents before. In 2025, the company disclosed that criminals had bribed overseas customer-support contractors and copied data from support systems affecting about 69,461 users.
Coinbase said that exposure included names, home addresses, phone numbers, email addresses, the last four digits of Social Security numbers, masked bank-account information, government-ID images, balance snapshots and transaction histories. It said passwords and private keys were not taken.
The company refused a $20 million ransom demand, offered a $20 million reward for information leading to arrests and convictions, removed implicated personnel and ended its relationship with the outsourced support provider. In its second-quarter 2025 filing, Coinbase reported approximately $307 million in costs connected to that incident, including customer reimbursements and legal expenses.
An earlier breach affected at least 6,000 Coinbase accounts between March and May 2021. Attackers obtained email addresses, passwords and phone numbers through phishing, then exploited a weakness in the company’s SMS-based account-recovery process to bypass two-factor authentication. Coinbase said it corrected the weakness and reimbursed stolen funds at their value during the incident.
That history means even a more limited exposure involving contact information can carry practical consequences. Criminals do not necessarily need access to an exchange’s internal systems if they can persuade a customer to disclose credentials, approve a malicious wallet transaction or transfer assets to an impersonator.
Phishing campaigns are becoming faster and more personalized
Research cited in public reporting suggests that automated tools are making these attacks more efficient. A Harvard Kennedy School collaboration with cybersecurity expert Bruce Schneier found that fully automated personalized spear-phishing created with large language models achieved click rates of about 54%, compared with roughly 12% for conventional phishing.
Microsoft has reported similar findings on phishing effectiveness and said the median time between public vulnerability disclosure and weaponization can be under 24 hours. CrowdStrike’s 2026 Global Threat Report said AI-enabled adversary activity rose 89% during 2025, while the average time attackers needed to move from initial access to lateral movement fell to 29 minutes.
Scam Sniffer reported that automated phishing campaigns stole roughly $84 million from digital wallets during 2025. Such operations increasingly rely on phishing kits and rented infrastructure that allow less technically skilled criminals to deploy fake support pages, malicious wallet prompts and targeted messages at scale.
IBM’s Cost of a Data Breach Report 2026 said about one-quarter of malicious breaches involved AI-related elements and reported higher average costs for those incidents. IBM also said the average U.S. breach cost reached $10.22 million in its October 2026 update.
For Coinbase users, the immediate risk described by the available information is likely to be deceptive outreach rather than a direct loss of funds from exchange infrastructure. Customers concerned about targeted scams can reduce exposure by using phishing-resistant security keys where available, reviewing old wallet approvals, placing a carrier-level PIN on mobile accounts and treating unsolicited support requests as potentially fraudulent.
Worried about exposed contact data? Learn how to improve crypto safety and harden your defenses against phishing and SIM-swapping attacks.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
