COINBASE is confronting a fresh security incident after Amplitude, a third-party analytics provider, suffered a data breach that exposed customer contact information.
Allegations circulated on X this week claiming attackers obtained contact details for more than 70,000 Coinbase users. Coinbase has not independently verified this figure.
The exchange moved quickly to draw a hard line: Amplitude experienced the breach—not Coinbase. In a statement, Coinbase affirmed that its core systems, trading platform, and user funds remain secure, with no evidence of unauthorized access to its own infrastructure.
"Coinbase has not had a data breach," the exchange said, noting that Amplitude, which provides analytics technology to measure customer engagement, experienced a security incident affecting a "small subset of Coinbase customer contact data" alongside other Amplitude clients.
Secondary accounts identified email addresses and telephone numbers as potentially compromised fields. Coinbase has not confirmed which specific data was exposed or the total number of affected customers. The method by which attackers breached Amplitude's systems also remains undisclosed.
Critically, no reports indicate compromise of user passwords, private keys, recovery phrases, or account balances. This separation matters: exposed contact data alone does not grant attackers direct access to funds. However, criminals can weaponize phone numbers and email addresses for phishing campaigns, fake customer-support calls, and SIM-swap attempts—social engineering vectors that do not require server access.
Coinbase has stated it is notifying affected customers and regulatory agencies, consistent with data breach notification obligations.
This incident echoes a May 2025 breach involving Taskus, a contractor-hired for customer support. Bribed Taskus personnel improperly accessed sensitive information for 69,461 Coinbase users, exposing personal identification records, financial information, and limited transaction histories. Attackers in that case demanded $20 million; Coinbase refused and absorbed remediation costs reaching hundreds of millions of dollars.
