Coinbase Customer Data Affected by Third-Party Security Incident
On October 28, 2026, Coinbase disclosed that a security incident at Amplitude, a third-party analytics provider, had affected a small subset of its customers' contact information. The exchange emphasized that the incident originated at the vendor rather than from unauthorized access to Coinbase's own systems.
In a statement published through its official support account, Coinbase said the incident affected limited customer contact data belonging to Coinbase and other Amplitude clients. The exchange reported no evidence of unauthorized access to its internal systems and confirmed that customer funds were not affected. It is notifying impacted customers and relevant regulatory agencies in accordance with its legal obligations.
Coinbase has not disclosed the exact number of affected customers or provided a complete list of the data fields involved. A company spokesperson told media outlets that the exposed information included contact details and limited transaction data, but not home addresses or information that would allow someone to directly access an account or customer funds. Online claims that more than 70,000 users were affected have not been confirmed by Coinbase, which described the reported figure as inaccurate.
Amplitude subsequently provided an update stating that it detected and contained unauthorized access to a localized portion of its internal systems on September 28, 2026. The incident affected event data from less than 0.3% of Amplitude customer accounts. This percentage refers to Amplitude's customer-account scope and should not be used to estimate the number of affected Coinbase users.
Third-Party Analytics Providers Expand the Security Perimeter
The incident highlights an important issue for digital asset businesses: keeping internal systems secure does not necessarily eliminate risks to customer information.
Crypto exchanges commonly rely on external providers for analytics, customer relationship management, marketing automation, and support operations. These services help companies understand user behavior, improve product experiences, and streamline business processes. However, using them may require platforms to share certain customer information with external organizations.
If a vendor's internal systems are accessed without authorization, customer data may be exposed even when the exchange's own infrastructure remains uncompromised. As a result, an organization's security perimeter should extend beyond trading systems, wallets, and internal servers to include every external service provider that can access customer information.
For crypto platforms, vendor risk management should cover data-sharing reviews, access controls, encryption, security assessments, and periodic audits. Companies should also minimize the amount of information shared with external providers and avoid giving analytics tools access to sensitive data that is not necessary for their intended functions.
Clear incident-response arrangements are equally important. Contracts and operational procedures should specify how quickly vendors must report security incidents, how investigations will be coordinated, how evidence will be preserved, and which parties are responsible for regulatory notifications.
Exposed Contact Information Can Enable Targeted Phishing
Even without evidence that passwords, private keys, or customer funds were compromised, exposed contact information can create follow-on risks. Attackers may use genuine customer relationships and contact details to make phishing emails, text messages, and phone calls more convincing.
For example, criminals could impersonate Coinbase support staff and claim that an account has been restricted, a withdrawal requires approval, or additional security verification is necessary. They may then direct users to fake websites, request authentication codes, or encourage them to transfer digital assets to a supposedly secure wallet. Access to genuine customer information can make these attempts more persuasive than generic spam.
Users should verify security notifications through the official application or by manually entering the platform's website address. They should avoid links in unsolicited messages and never disclose passwords, two-factor authentication codes, or wallet private keys. Exchanges, meanwhile, should strengthen suspicious-login monitoring, account protection measures, and customer alerts following third-party security incidents.
The incident demonstrates that crypto security depends on more than wallet infrastructure and private-key protection. It also requires effective oversight of external providers and the data they handle. As digital asset businesses become increasingly dependent on third-party technology services, vendor security assessments and data minimization will remain essential elements of long-term cybersecurity governance.