Coinbase pinned an exposure of some customer contact information on Amplitude, a third-party analytics provider, late Tuesday, while saying the exchange itself had not been breached.
“Coinbase has not had a data breach,” the company’s support account wrote on X on the evening of Oct. 27, U.S. time. According to the post, an incident on Amplitude’s side “impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
Coinbase said it had “found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.”
Claims of a breach had circulated on X for nearly three hours before Coinbase posted. Around 8 p.m. ET on Oct. 27, an account called DelCrxpto posted, without citing a source, that a Coinbase breach was confirmed and that hackers had obtained contact details for more than 70,000 users. About two hours later, 23pds, who describes himself on X as a partner and chief information security officer at blockchain security firm SlowMist, repeated those claims while quoting that post. Unchained did not find any report from SlowMist itself, and Coinbase did not address the figure.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What the Post Leaves Out
The exchange did not give a count of affected users, list which contact fields were involved, or say when the incident at Amplitude occurred. It also did not name the other Amplitude clients whose data was touched.
Coinbase said it is “notifying impacted customers and regulatory agencies in accordance with our legal obligations.” No statement about the incident appeared on Amplitude’s blog at the time of publication. Neither Coinbase nor Amplitude immediately responded to a request for comment from Unchained.
Leaked contact details such as email addresses and phone numbers are a common starting point for phishing. In recent days, Passport hardware wallet maker Foundation traced phishing emails to a backend breach, and Keystone said an intruder took customer names and addresses from its website.
Coinbase’s 2025 Insider Incident
Coinbase has dealt with exposed customer data before. In May 2025, the exchange disclosed that criminals had bribed overseas support staff to pass along user information, that it would not pay a $20 million extortion demand, and that it estimated remediation costs and customer reimbursements at $180 million to $400 million. In a filing with Maine’s attorney general, Coinbase said 69,461 users would be notified.
Tuesday’s post did not tie the Amplitude incident to that earlier case. Coinbase has not said whether customers whose contact data was exposed should take any specific steps.
Related Listen: How AI Agents Are Exposing a Bank Business Model Built on ‘Laziness’
