Coinbase says analytics vendor Amplitude's security incident exposed some customer contact data

Coinbase said a security incident at Amplitude, a third-party analytics provider, affected contact data belonging to a “small subset” of its customers, and denied that the exchange itself had been breached.

“Coinbase has not had a data breach,” the company’s Coinbase Support account said on X late on Tuesday 27 October (US time). “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”

The company said it had found no evidence of unauthorised access to its systems and that customer funds were not affected, according to Decrypt. It said it was notifying affected customers and regulators as required by law.

Coinbase did not say how many customers were affected, which contact details were involved or when the incident took place, CoinDesk and Decrypt reported.

CoinDesk noted that exposed email addresses and phone numbers can be used in phishing and social-engineering attempts even when passwords and funds are not compromised.

In May 2025 Coinbase disclosed a separate incident in which criminals bribed overseas customer support agents to obtain customer data; a later filing with the Maine attorney general put the number of affected customers at 69,461, Decrypt reported.

Coinbase reports its third-quarter results on Thursday, CoinDesk reported.