Key Takeaways
- Coinbase says the Amplitude leak did not compromise its systems or customer funds.
- The company claims that the leak affected 70,000 users, but this remains unconfirmed.
- However, exposed contact details could fuel phishing and impersonation scams.
Coinbase has acknowledged that a security incident at analytics provider Amplitude affected some customers’ contact information, raising fresh concerns about privacy and phishing risks at the cryptocurrency exchange.
However, Coinbase denies that attackers breached its own systems and says customer funds remain unaffected. Claims that the exposure involves more than 70,000 users remain unconfirmed by the company.
The distinction matters: while the incident does not establish that attackers accessed Coinbase accounts, the exposure of contact details could give scammers another route to target customers.
What Happened at Coinbase’s Analytics Vendor?
“Coinbase has not had a data breach,” the company’s support account said on X, identifying Amplitude as the source of the incident.
According to Coinbase, the analytics vendor experienced a security incident that affected a small subset of Coinbase customers’ contact data, as well as information belonging to other Amplitude customers.
The exchange said it found no evidence of unauthorized access to its systems and was notifying affected customers and regulatory agencies.
The statement did not identify the exact number of affected users, specify which contact fields the incident exposed, or explain how attackers accessed the information.
The claim involving more than 70,000 users circulated separately. CoinNess reported that SlowMist Chief Information Security Officer 23pds shared the figure, citing crypto influencer DelCrxpto. That attribution does not amount to independent verification, and Coinbase has not endorsed the estimate.
For now, the confirmed exposure concerns customer contact data. Broader claims about stolen credentials or compromised accounts go beyond what Coinbase disclosed.
Why Contact Data Can Still Put Customers at Risk
Binance co-founder Changpeng Zhao highlighted the Coinbase incident in a post discussing reported leaks involving Bithumb and South Korean securities firms Mirae Asset and Daishin Securities.
CZ warned that criminals can exploit leaked exchange data for phishing, SIM swapping and social engineering. His list described potential consequences of financial-data leaks generally; it did not establish that the Amplitude incident exposed identity documents, addresses or transaction histories.
Contact information alone can nevertheless make impersonation attempts more convincing. A message that identifies its recipient as a Coinbase customer may appear credible, particularly when it references a genuine security incident.
Attackers could exploit that credibility through fake breach notifications, account-verification requests, or instructions to move cryptocurrency to a supposedly secure wallet.
Coinbase’s published security guidance says its staff will never request passwords or two-factor authentication codes, or instruct customers by phone or text to transfer funds to a specific destination.
Those rules offer customers a practical way to identify fraudulent approaches.
Zhao also recommended unique passwords, hardware security keys or passkeys, and avoiding SMS authentication where possible.
Coinbase’s Earlier Breach Shows the Stakes
The latest disclosure follows a separate incident that Coinbase announced in May 2025. Then, criminals bribed overseas support personnel to obtain customer information.
That earlier theft involved names, contact details, government identification images, balance snapshots, and transaction histories.
Coinbase said the attackers intended to impersonate its staff and persuade customers to hand over cryptocurrency. The company rejected a $20 million ransom demand and instead announced a reward fund of the same size.
Initially, Coinbase estimated that remediation and voluntary customer reimbursements could cost between $180 million and $400 million. That historical estimate pertained to the 2025 incident rather than the newly disclosed Amplitude exposure.
The earlier case illustrates why customer data security matters even when attackers cannot directly access wallets.
For the Amplitude incident, unanswered questions include the verified customer count, the precise information affected, and the timeline. Until Coinbase provides those details, 70,000 remains an unconfirmed claim, while the company maintains that customer funds were unaffected.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
