Coinbase, the largest US crypto exchange, says a security problem at one of its suppliers exposed contact information for some of its customers. In a post on X early on Wednesday, October 28, 2026, the company’s support team said the incident happened at Amplitude, an analytics company that Coinbase and many other firms use, and not inside Coinbase itself.
Key facts
- Where it happened: at Amplitude, a third-party analytics vendor. Other Amplitude clients were affected too, not only Coinbase.
- What was exposed: customer contact data for what Coinbase calls a “small subset” of its users.
- What was not affected: Coinbase says it found no evidence of unauthorized access to its own systems, and that customer funds are safe.
- How many people: Coinbase has not given a number.
- Next steps: Coinbase is emailing the affected customers, as the law requires.
Coinbase’s first line was blunt: it said it “has not had a data breach”, pushing back on online reports that the exchange itself had been hacked.
Context
Coinbase has been here before. In May 2025 it revealed that criminals had bribed support staff at an outside contractor to steal customer data, then used it to trick people out of their money. About 69,000 customers were affected, and Coinbase estimated the cost of reimbursements and clean-up at up to $400 million.
This week’s incident is different: it involves contact details held by an analytics tool, not data taken from Coinbase’s support systems. It also lands in a busy week for crypto security, with South Korean exchange Bithumb separately reporting a breach of an internal employee system.
What customers can do
Contact details are exactly what scammers need to send convincing fake emails, texts and calls. If you use Coinbase:
- Be suspicious of any message about a “security problem” with your account, especially one that creates urgency.
- Never share your password, two-factor codes or recovery phrase, and never move funds to a “safe” wallet because someone told you to.
- Open the official app or type the website address yourself instead of clicking links in messages.
Why it matters
Even when no money is taken, leaked contact lists feed the phishing and impersonation scams that cost crypto users the most. The incident is also a reminder that a company’s security depends on every outside tool it shares customer data with, not only on its own systems.
This article is for information only and is not financial advice.
