coinbase amplitude Vendor Hit Exposed Contact Data
The coinbase amplitude incident exposed a small subset of customer contact data at the analytics vendor, while Coinbase denied a breach of its own systems.
Early story. Some claims here are not officially confirmed yet. We update this post as it confirms.
- Support X post: no evidence of unauthorized access to Coinbase systems; funds untouched.
- Unchained spokesperson: contact and limited transaction data impacted; not home addresses or direct account-access info; notifying customers and regulators.
- Coinbase called a circulating ">70,000 users" claim false; do not treat that number as confirmed.
in this block
The coinbase amplitude incident is a vendor story, not a claim that Coinbase's own systems were cracked. Late on October 27 US time, Coinbase Support said on X that Coinbase had not had a data breach, that an Amplitude incident hit a small subset of Coinbase customer contact data among other Amplitude customers, and that funds were not impacted.
What actually happened
Unchained reported that Coinbase tied the exposure to analytics provider Amplitude and said the exchange itself was not breached. In an emailed statement on Wednesday, a Coinbase spokesperson told Unchained that "contact and limited transaction data were impacted" but "not home addresses, or any other information that would allow someone to directly access your account or your funds." The company said it is notifying affected customers directly and notifying regulators.
Neither the X post nor the spokesperson gave a count of affected users or said when the Amplitude incident began. Amplitude had no blog statement at Unchained's publish time and did not immediately comment. Decrypt and CoinDesk carried the same core framing: third-party vendor exposure, funds safe, phishing risk elevated because emails and phones can leak.
A separate claim that hackers grabbed contact details for more than 70,000 Coinbase users spread on X before Coinbase posted. Unchained said Coinbase's spokesperson called that figure false and believed it conflated this Amplitude case with Coinbase's May 2025 insider incident. In that earlier case, Maine's attorney general filing said 69,461 users would be notified after overseas support staff were bribed. Tuesday's coinbase amplitude update did not tie the two events together.
Why vendor analytics still matter
Exchanges outsource product analytics. When the vendor is hit, contact fields can spill even if the exchange's production wallets stay sealed. That is supply-chain risk in plain English: your email and phone become phishing bait while balances stay behind Coinbase's own auth stack.
CoinDesk framed the episode that way for readers who still assume "Coinbase breach" means hot wallets. The practical threat is social engineering. Attackers who know you use Coinbase can spoof support emails, Telegram handles, or SMS codes. Hardware-wallet makers Foundation and Keystone had their own contact-leak phishing notes in the same news cycle, Unchained noted, which shows how common this pattern is right now.
For context on how crypto firms talk about customer safety after operational stress, pair this with our coverage of regulated product launches like Crypto.com US perps and infrastructure trust stories such as Ripple trust bank. Different topics, same reader job: separate marketing claims from what was actually exposed.
What Coinbase did and did not say
Confirmed in coverage: Amplitude customers including a Coinbase subset had contact data impacted; Coinbase denies a breach of its own systems; funds not impacted; notifications underway; >70k claim denied.
Not confirmed: a public headcount for this Amplitude subset; a start date for the vendor incident; a list of other Amplitude clients affected; mandatory user steps beyond watching for phishing. Do not invent a user count to fill that gap. The coinbase amplitude file is thinner on numbers than the May 2025 Maine filing, and that is intentional on Coinbase's part so far.
Contact data is not seed phrases. It is still enough for a convincing fake support chat.
What to do as a reader
If Coinbase messages you about the coinbase amplitude case, verify it inside the official app or a bookmark you already trust, not from a cold email or SMS. Assume phishing volume rises whenever emails and phones leak. Coinbase has not published a checklist beyond notifying affected customers, so default to skepticism on unsolicited links.
Separate this Amplitude vendor incident from the May 2025 insider case (69,461 in the Maine AG filing). Mixing them inflates fear and muddies what actually changed this week. Nothing here is investment advice, and no article can replace Coinbase's own notice if you are in the notified set.
Readers who only skim headlines will miss the vendor distinction. Bookmark Coinbase Support's own post and Unchained's spokesperson quotes before you reshare a screenshot about the coinbase amplitude exposure, because the phishing wave usually starts in the replies.
Not financial advice. DYOR, ser.
