VULNpocalypse
MediumBreach / campaignMonitoring

Coinbase customer contact and transaction data exposed in an incident at analytics vendor Amplitude

An incident at analytics vendor Amplitude exposed contact and some transaction data of Coinbase customers. Coinbase says its systems and funds were not hit.

Published
Updated
Exploitation
Yes. Coinbase confirms customer data was exposed at Amplitude; how and when is not disclosed

What happened

Amplitude is a product analytics service that companies feed with events about how their users behave. Coinbase uses it.

  • 27 October 2026, evening US time: Coinbase Support posted on X that a security incident at Amplitude “impacted a small subset of Coinbase customer contact data, among other Amplitude customers”. It said “Coinbase has not had a data breach”, that it found no evidence of unauthorized access to Coinbase systems, and that customer funds were “not impacted”. It is notifying affected customers and regulators (Decrypt; Bitcoin.com News).
  • 28 October: a Coinbase spokesperson told Unchained that “contact and limited transaction data were impacted”, but “not home addresses, or any other information that would allow someone to directly access your account or your funds” (Unchained via Yahoo News).

The 70,000 figure is disputed. A claim that hackers got contact details for more than 70,000 users first appeared, without a source, from the X account DelCrxpto on the evening of 27 October, and was repeated by a SlowMist executive. Coinbase’s spokesperson called it “false” and suggested it came from Grok conflating this incident with Coinbase’s May 2025 insider case, which affected 69,461 people. Unchained could not confirm where the number started (Unchained via Yahoo News).

What is not disclosed:

  • How Amplitude was breached, and when.
  • How many Coinbase customers were affected.
  • Which contact fields (email, phone, name) and which transaction details were exposed.
  • Which other Amplitude customers were hit.

Amplitude did not respond to Unchained’s request for comment, and had no statement on its blog at the time (Unchained via Yahoo News). As of 2 November 2026 the Amplitude blog still shows no incident post. Everything known comes from Coinbase.

Am I affected?

Coinbase customers. Coinbase has not published a lookup. It says it is contacting affected customers directly (Decrypt). Coinbase has not said what the notice looks like or which channel it uses, so do not act on links in a message that claims to be it; open the app or type the address yourself. Coinbase says the data did not include “any other information that would allow someone to directly access your account or your funds” (Unchained via Yahoo News), so this incident on its own does not mean your account is compromised.

Companies that use Amplitude. Coinbase says other Amplitude customers were affected too. Work out what your exposure would be:

  • Which user properties you send: email, phone number, name, wallet or account identifiers, transaction amounts or types. Your tracking plan, or the identify calls in your code, will show this.
  • Whether you sync data into Amplitude from a warehouse or CDP, which often carries more fields than the browser SDK.
  • Whether you received anything from Amplitude, and whether your privacy notice lists Amplitude as a processor that holds this data.

What to do now

  1. Coinbase customers: expect phishing that knows your trades. Exposed contact and transaction data can be used for fake support calls and SIM-swap attempts (Bitcoin.com News). A caller who quotes a real purchase is not proof they work for Coinbase.
  2. Coinbase customers: harden the account the attacker would aim for. Use a passkey or security key for sign-in instead of SMS, and ask your mobile carrier to add a port-out PIN in case your phone number was part of the “contact data”.
  3. Amplitude customers: ask Amplitude in writing whether your organisation and projects were in scope, what data was accessed, and the dates. Your own breach-notification clock may depend on the answer.
  4. Amplitude customers: stop sending what analytics does not need. Replace emails and phone numbers with an internal user ID in identify calls, and drop transaction values that are not used in a chart. Then ask Amplitude to delete the historical copies it already holds.

Sources