Key Takeaways
- The Coinbase Support X account confirmed an Amplitude vendor incident but denied any unauthorized access to its systems.
- Claims that more than 70,000 Coinbase users were affected remain unverified.
- Coinbase faces renewed questions about third-party security following its costly 2025 incident.
Coinbase Denies Direct Breach as 70,000-User Claim Circulates
This week, Coinbase acknowledged a security incident involving Amplitude, a third-party analytics provider that processes customer information. The disclosure followed allegations circulating on X that attackers had obtained contact details belonging to more than 70,000 Coinbase users.
Alongside this, Coinbase rejected suggestions that its infrastructure had been breached, drawing a firm distinction between compromised vendor data and unauthorized access to its trading platform. The centralized exchange (CEX) platform‘s X account stated:
“Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.”
The company has not disclosed how many customers were affected, what specific information was exposed, or how attackers gained access. Accounts, including Delcrxpto and Slowmist security executive 23pds, circulated the 70,000-user figure, which remains unverified at press time.
Third-Party Exposure Raises Phishing Concerns
Amplitude provides analytics technology that helps businesses measure customer engagement and interactions with digital products. Such arrangements can expose information outside a company’s primary infrastructure when a vendor experiences a security failure. Secondary accounts identified email addresses and telephone numbers as potentially compromised information, although Coinbase has not independently confirmed those specific fields.
No compromise of passwords, private keys, recovery phrases, or account balances has been reported. Nevertheless, exposed contact information can furnish scammers with material for targeted phishing campaigns, so-called wrench attacks, fraudulent customer-support calls and SIM-swap attempts. The distinction is consequential. Criminals don’t necessarily need access to an exchange’s servers to impersonate its representatives and persuade customers to surrender credentials. Coinbase said it is notifying affected customers and regulators as required.
Previous Contractor Breach Cost Coinbase Hundreds of Millions
The disclosure follows a substantially more damaging contractor-related incident uncovered in May 2025, when bribed customer-support personnel working for Taskus improperly accessed sensitive information belonging to 69,461 Coinbase users. That specific episode involved personal identification records, financial information, and limited transaction histories.
Attackers demanded $20 million, which Coinbase refused to pay, while remediation expenses and related costs reached hundreds of millions of dollars. The latest incident appears considerably narrower, with no reported loss of customer assets or intrusion into Coinbase systems. Its timing also puts the exchange under scrutiny ahead of third-quarter earnings scheduled for Thursday, Oct. 29.
For now, Coinbase has offered assurances about its systems but little detail about the vendor intrusion itself. The unanswered question is how much customer information left Amplitude’s control, and who now possesses it.
