Coinbase: no systems breach; Amplitude incident exposed contact info for a subset of users

Coinbase said on October 27, 2026 that reports of a hack of its own systems are wrong, and that a security incident at Amplitude — a third-party analytics vendor — exposed contact information belonging to a "small subset" of Coinbase customers along with data on other Amplitude clients. Coinbase says its own infrastructure was not breached and customer funds are safe. Affected users are being notified by email "as required by law." Reporting: CoinDesk, The Defiant, Crypto Briefing.

What happened

• Where: The incident originated at Amplitude, a third-party product-analytics provider used by Coinbase and other customers.
• Data: Contact information for a subset of Coinbase customers. Coinbase did not specify which fields were exposed, nor how many customers were affected.
• Not exposed, per Coinbase: Passwords, private keys, customer funds. The exchange says its own systems detected no unauthorized access.
• Notifications: Affected users are being contacted by email. The article does not describe filings with regulators.
• Public line: Coinbase explicitly denied the exchange was hacked.

Mechanism — what analytics vendors typically hold

Amplitude is used by product teams to track in-app events: what users click, what paths they take, which features they adopt. The data commonly passed to an analytics vendor includes:

• A user identifier (hashed or raw user ID).
• An email address or phone, when the implementation chooses to pass it as a user property.
• Device, browser, locale, IP address metadata.
• Event streams describing which product surfaces a user hit and when.

Credentials, 2FA secrets and private keys sit on the exchange's own authenticated systems, not inside a product-analytics stream.

Impact

• Phishing is the primary risk. Email and phone paired with a confirmed signal that the account belongs to a crypto-exchange user is the exact profile phishing crews target with "Coinbase support" and "address change confirmation" lures. Users should treat any unsolicited support contact as suspicious.
• Blast radius beyond Coinbase. Amplitude is a shared vendor across consumer apps. The incident exposed data for other Amplitude clients too, which means other brands may issue their own disclosures.
• Signal-vs-noise on "Coinbase hacked." Several first-wave posts on social described the incident as a Coinbase breach. Coinbase's statement — "Coinbase was not hacked" — is a correction, not a denial of impact.

What to watch

1. Amplitude's own disclosure, including the vector and the full list of affected customers.
2. The scope Coinbase publishes once its investigation closes — number of users, specific fields exposed.
3. Related disclosures from other Amplitude customers operating in regulated spaces (fintech, brokerages).
4. Phishing clusters targeting Coinbase users in the days ahead; wallet-drainer kits typically rotate within 24–72 hours of a disclosure like this.

Context

Coinbase is still working through the fallout of its May 2025 breach, in which overseas support contractors were paid to leak customer data and the company pre-emptively disclosed and offered a bounty rather than paying extortion. Amplitude is a different kind of incident — vendor-side, not an insider — but the common thread is the same: the customer-data surface area of a major exchange extends well past its own perimeter. Every analytics, CRM, call-center and KYC vendor that touches a user record is a potential disclosure vector, and attackers have been working that perimeter for the better part of two years. Users of any major exchange should assume their email and phone are at least partially known, and should rely on hardware 2FA, a passkey, and a withdrawal allowlist rather than on the secrecy of their contact details.