Coinbase: vendor Amplitude breach exposed some user contacts

Coinbase says it was not hacked, but some of its customers' contact details were exposed through a security incident at Amplitude, a third-party analytics provider it uses. The exchange says customer funds are safe and its own systems show no unauthorised access, according to its support account on X and CoinDesk. Here is what we know so far.

Coinbase denies a direct hack

Reports on Wednesday described a Coinbase breach. The company pushed back: the incident originated at Amplitude, not on Coinbase infrastructure, and "customer funds remain safe." Passwords, private keys and balances were not part of the disclosure.

The leak started at a vendor

Amplitude is a product-analytics company that many apps use to track how people use their services. The exposed data set covers a "small subset" of Coinbase customers' contact information as well as data belonging to other Amplitude clients. This is a classic supply-chain risk: a company's core systems can be secure while a partner holding some of its data is not.

Key details are still missing

Coinbase has not said how many customers are affected or exactly which contact fields leaked (email addresses, phone numbers or both). It is notifying affected users by email, as the law requires.

Why contact data still matters

An email address or phone number linked to a known Coinbase account is valuable to scammers. It lets them send convincing fake "account locked" emails, call pretending to be support, or try to talk you into moving funds to a "safe wallet". The same week, South Korean firms including Bithumb disclosed data breaches after cyberattacks.

What Coinbase users should do now

• Treat unexpected calls, texts and emails about your account as suspicious; open the app yourself instead of clicking links.
• Coinbase staff will never ask for your password, 2FA codes or a recovery phrase. Read what a seed phrase is and why nobody legitimate needs it.
• Use an authenticator app or security key rather than SMS codes.
• Never move coins to an address someone gives you over the phone. Our guide on how to spot crypto scams covers the common scripts.