SECURITY ALERT

The vault held.

The address book did not.

Coinbase says an incident at one of its vendors has exposed contact data belonging to some of its customers.

“Coinbase has not had a data breach,” Coinbase Support said on X.

“Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”

The exchange says it found no evidence of unauthorized access to its own systems and that customer funds were not affected.

It is notifying affected customers and regulators “in accordance with our legal obligations”, the post said.

Coinbase has not said how many customers are involved, which contact fields were taken, or when the incident happened, CoinDesk reported.

Amplitude had not commented publicly as of 05:00 UTC.

What happened, in UTC

  • Wednesday 28 Oct, 00:01. An anonymous X account claims Coinbase has been breached and that contact details for more than 70,000 users were taken.
  • 02:17. A researcher at security firm SlowMist who posts as 23pds repeats the 70,000 figure and calls the breach confirmed.
  • 02:42. Chinese-language outlet Foresight News carries Coinbase’s response.
  • 02:49. Coinbase Support posts the statement on X.
  • 03:12. 23pds shares Coinbase’s response and warns that many crypto projects use Amplitude.

So who is right about the size?

Claimed, not confirmed

The 70,000 figure is a claim.

Coinbase has not confirmed it, and neither account that posted it has shown evidence.

What Coinbase has confirmed is narrower: contact data, a “small subset” of customers, through a vendor.

Amplitude sells product analytics. Companies use it to see how people click through their apps.

Its other clients were also hit, Coinbase says. None has been named.

This is the third incident in a week that runs through a third-party service. Foundation’s phishing emails sent through leaked Cloudflare keys came from its own domains, and Predict.fun’s loss of about 400,000 USDT was blamed on a third-party-hosted docs site.

Coinbase has been here before. In May 2025 it said criminals had bribed overseas support agents to copy customer records. That incident affected over 69,000 users, India Today noted.

If no money moved, what is the risk?

The data is the bait

Contact details are what phishing runs on.

An email address and a phone number are enough to send a convincing “Coinbase security” message, CoinDesk noted.

This week the timing is worse. EEA customers are already expecting real emails about Coinbase’s deadline to convert EEA users’ USDT on 30 Oct.

Scammers love a real deadline.

Protect yourself

  • Treat any call, text or email about this incident as suspect. Coinbase says it is notifying affected users; check for messages inside the app, not via links.
  • Coinbase staff will never ask you to move funds to a “safe” wallet. Anyone who does is not Coinbase.
  • Never share a seed phrase or what a private key is. No exchange needs it.
  • Turn on a hardware security key or an authenticator app, and drop SMS codes where you can.
  • Report impersonation attempts to Coinbase support from inside the app.

If a vendor can leak the address book, who audits the vendors’ vendors?

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.