Coinbase has confirmed that a security incident at third-party analytics provider Amplitude exposed a subset of Coinbase customer contact information, while denying that its own systems were breached. A claim from a blockchain security researcher that more than seventy thousand users may have been affected remains unconfirmed by the exchange, leaving the scale of the exposure unresolved.
In a public statement, Coinbase Support said Amplitude experienced a security incident affecting customer contact data associated with multiple companies. Coinbase added that it had found no evidence of unauthorized access to its internal systems and that customer funds were not affected. The exchange said it was notifying impacted users and relevant regulatory authorities in accordance with legal requirements.
The distinction between a vendor-side incident and a direct exchange compromise is central to understanding the event. Coinbase's statement indicates that the reported exposure originated within a third-party service rather than its own infrastructure. However, the absence of evidence that Coinbase's internal systems were accessed does not eliminate the risks associated with customer information held by external providers.
The exchange has not disclosed how many customers were affected, which specific contact fields were exposed, or when the incident at Amplitude occurred. Its description of the affected population as a “small subset” therefore provides limited insight into the potential scale of the exposure.
The uncertainty intensified after a security researcher associated with blockchain security firm SlowMist, posting under the handle 23pds, claimed that hackers had obtained contact information belonging to more than seventy thousand users. The researcher also said it was not immediately clear whether passwords or funds had been stolen.
Coinbase has not confirmed that figure. The difference between the researcher's estimate and the exchange's characterization remains unresolved, and the available information does not establish whether the reported exposure involved email addresses, phone numbers, or additional identifying information.
Amplitude provides product analytics that help companies understand how users interact with their applications and websites. Depending on how a service is configured, an analytics provider may process or retain customer identifiers as part of that functionality. A security incident at such a provider can consequently expose information associated with a major exchange without requiring direct access to the exchange's own databases.
For Coinbase, the immediate concern is therefore not evidence of a compromise of customer balances, but the potential misuse of exposed contact information. Email addresses and phone numbers can enable targeted phishing campaigns in which attackers impersonate exchange support teams, create false security alerts, or attempt to persuade users to disclose authentication credentials.
Such attacks can exploit the credibility of a legitimate relationship with a financial platform. A message referencing a user's exchange account may appear convincing even when the sender has no access to the account itself. The distinction between exposed contact data and compromised credentials is important, but it does not make the former risk-free.
The incident also highlights a broader operational challenge for digital-asset companies: their security exposure extends beyond the systems they directly control. Analytics providers and other external services can become potential points of failure when they process information connected to customers. Security assurances focused exclusively on an exchange's internal infrastructure may therefore provide an incomplete picture of the risks facing its users.
The Coinbase disclosure comes amid other reported security incidents involving financial institutions. South Korean cryptocurrency exchange Bithumb confirmed that an outside party accessed its internal mobile groupware system and leaked personal data. Authorities are also investigating incidents involving Mirae Asset Global Investments and Daishin Securities.
Daishin Securities disclosed that personal and credit information belonging to thirty-eight thousand four hundred ninety customers had been leaked. If the researcher's estimate for the Coinbase-related incident is accurate, the number of potentially affected Coinbase users would be substantially higher. However, the incidents involve different organizations and systems, and the available information does not establish a connection between them.
The clustering of disclosures highlights the importance of examining security controls across both internal platforms and external service providers. It also raises questions about how financial institutions assess vendor access, limit the information shared with third parties, and respond when customer data may have been exposed outside their primary infrastructure.
For Coinbase, the next important development will be a more detailed account of the incident's scope. Confirmation of the affected user count, the categories of exposed information, and the circumstances of the Amplitude incident would help determine whether the event was a limited disclosure or a broader customer-data exposure.
Users should remain alert to unsolicited messages claiming to originate from Coinbase. Avoiding links in unexpected emails and text messages, accessing the exchange by entering its official website address directly, maintaining two-factor authentication, and using a unique account password can reduce the risk of account compromise through phishing.
For the market, the available facts do not establish a loss of customer funds or a breach of Coinbase's internal systems. The immediate issue is the uncertainty surrounding customer-data exposure and the potential consequences for users. Further disclosure from Coinbase or Amplitude will be important in determining the incident's actual scale and whether additional security concerns emerge.
