Contact information for some Coinbase customers was exposed in a security incident at analytics vendor Amplitude, the exchange said Wednesday. Coinbase denied that its own systems were breached.
In a post on X, Coinbase Support said the incident affected a "small subset" of Coinbase customer contact data. Data belonging to other Amplitude clients was also affected.
"Coinbase has not had a data breach," the company said. "We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted."
Coinbase said it is notifying affected customers and regulatory agencies in line with its legal obligations. It did not disclose the number of affected accounts. It also did not specify which contact fields the exposed records contained.
How many users were affected remains unconfirmed
Online reports that cite blockchain security firm SlowMist have put the number of affected users at more than 70,000. Coinbase has not confirmed that figure.
Amplitude sells product analytics software that records how people use apps and websites. Coinbase did not say when the incident took place or what Coinbase data Amplitude held.
For affected customers, the label on the incident matters less than what attackers can do with the data. A name and phone number are enough to start a scam call. An email address on an exchange's customer list tells a fraudster that the recipient holds crypto.
Leaks in South Korea reported on the same day
Coinbase's disclosure came on a day of separate data incidents in South Korea. Bithumb is investigating whether a breach of its internal work platform exposed customer information. Brokerage Daishin Securities reported a leak of personal and credit information that belonged to 38,490 customers.
Former Binance CEO Changpeng Zhao counted four leaks in a post on X. He added Mirae Asset, another Korean securities firm, to the list but gave no details about that case.
"You can't prevent a leak, but you can protect yourself," Zhao wrote.
4 data leaks reported today:
— CZ 🔶 BNB (@cz_binance) October 28, 2026
1. Coinbase's vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.
In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin Securities
You can't prevent a leak, but…
Phone numbers draw the sharpest warnings
Much of Zhao's advice addressed the phone number, which he described as the main entry point for account takeovers. He told users to avoid SMS two-factor authentication. He also suggested that they register a separate email alias for each exchange.
"Use a dedicated phone number (a VoIP or secondary SIM) for exchange accounts if you can, since leaked numbers are the main route to SIM swaps," he wrote.
He also recommended that users ask their mobile carrier for a port-out PIN or number lock. In the United States, the Federal Communications Commission adopted rules in November 2023 that require wireless carriers to use secure methods to authenticate customers before a number moves to a new device or carrier. Carriers must also notify customers of such requests.
The U.S. Cybersecurity and Infrastructure Security Agency identifies FIDO/WebAuthn authentication, the technology behind hardware security keys and passkeys, as the most widely available phishing-resistant form of multifactor authentication. Zhao recommended those options over authenticator apps where exchanges support them.
His post also warned that leaked addresses combined with holdings data have led to extortion and robberies. In January 2025, Ledger co-founder David Balland was kidnapped from his home in France. Police later freed him.
Coinbase's earlier support-agent breach
The Amplitude incident is separate from a data breach that Coinbase disclosed in May 2025. That breach affected less than 1% of the exchange's monthly transacting users, and Coinbase estimated reimbursement and remediation costs at up to $400 million.
In that case, Coinbase said criminals had bribed customer support agents outside the United States to copy customer data from its internal systems. The stolen records included names, addresses, phone numbers, email addresses and images of government IDs, according to the company.
The attackers then demanded $20 million from Coinbase, which refused to pay. The exchange instead offered a $20 million reward for information that would lead to the arrest and conviction of those responsible.
Coinbase's Wednesday statement did not say whether customers affected by the Amplitude incident would receive any support beyond the notifications.
Matvii Diadkov
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
