By Coinbase told customers on Wednesday morning that the exchange itself was not compromised, and that contact details for a small subset of users were exposed through Amplitude, an analytics vendor it shares with other companies. “Coinbase has not had a data breach,” the support account posted on X, adding that it found no evidence of unauthorized access to its own systems and that customer funds were untouched.
Whether that counts as a Coinbase data breach is the question the statement is built to answer, and it is precise about what did not happen while staying quiet on scale. Coinbase has not said how many customers are affected, which fields were taken, or when Amplitude was compromised. It says it is notifying affected customers and regulators in line with its legal obligations.
Coinbase has not had a data breach.
Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.— Coinbase Support (@CoinbaseSupport) October 28, 2026
The Coinbase Data Breach Denial Names Amplitude and No Customer Count
Amplitude sells product analytics, which means it receives behavioral and identity data from inside its clients’ apps rather than holding it at the perimeter. Coinbase described the exposure as contact data for a small subset of users, and said Amplitude’s other customers were hit as well without naming any of them.
No filing or formal notice has followed the social post, and Amplitude’s own trust center carried no incident notice when checked. A Coinbase data breach of the kind the company is denying would normally arrive with a count, a date and a list of fields, and none of the three has been published by either party. Coinbase closed Tuesday at $158.13, down 2.95%, already 19.86% lower over a month and 52.36% lower over a year, against a 52-week range of $139.11 to $373.25.
A $2.16 Billion Vendor Holds Data for a $42 Billion Exchange
Amplitude trades on Nasdaq with a market value of about $2.16 billion, against Coinbase at roughly $42 billion. The exchange that spent heavily to harden itself after being robbed through its own staff was exposed this week through a supplier a twentieth of its size.
That asymmetry is the structural problem behind this Coinbase data breach dispute, and the semantics of whose systems were touched do not change it for the customer whose phone number is now circulating. Coinbase chose the vendor, sent it the data and carries the notification duty, which is why it is the one writing to regulators. Amplitude trades near the top of its 52-week range of $5.51 to $17.72, so the market has not treated this as a Coinbase data breach that damages the supplier either.
Investor Takeaway
Coinbase has disclosed no customer count, no data categories and no incident date for the Amplitude exposure, so the scale of this Coinbase data breach is unquantified and the denial rests on whose systems were touched rather than on whose data moved.
The Last Coinbase Data Breach Cost Up to $400 Million
An 8-K filed on 15 May 2025 described a far worse episode seventeen months ago. Overseas support contractors were paid to pull customer records from internal systems, exposing names, contact details, masked Social Security and bank account numbers, government ID images, balance snapshots and transaction history. A later filing with the Maine attorney general put the count at 69,461.
Coinbase refused the ransom and estimated remediation and voluntary reimbursement expenses “within the range of approximately $180 million to $400 million.” Passwords, private keys and funds were not compromised in that Coinbase data breach either, which did not stop the phishing campaigns that followed. Contact details alone carry a market price, with stolen card data selling for about £9 and full identity packages for £30 across 28,000 dark web listings tracked by NordVPN.
Bithumb, Daishin and Mirae Asset Disclosed Inside the Same 48 Hours
Three South Korean financial firms reported incidents inside the same 48 hours. Bithumb confirmed an intrusion into its internal mobile groupware system on 27 October and reported it to the Korea Internet and Security Agency and the Personal Information Protection Commission, saying the system is isolated from its trading infrastructure. Daishin Securities confirmed a breach of a remote account-opening server affecting 38,490 customers across eight data categories. Mirae Asset Global Investments said outsiders viewed internal business systems without valid credentials.
Korean regulators identified security incidents at 16 financial businesses earlier in October. Binance co-founder Changpeng Zhao responded to the cluster by warning that leaked names, emails, phone numbers and transaction histories feed phishing, SIM swapping and social engineering, advising users to move off SMS two-factor authentication and treat support contact as suspect. That is the channel a Coinbase data breach opens even when no money leaves an account.
Similar follow-on activity already runs through fake crypto recovery firms targeting scam victims, which the FBI has warned about, and through the scam compounds US authorities say they disrupted this year. Enforcement has reached the operators too, with 28 arrests across Ghana and Nigeria in crypto-linked scam networks.
Investor Takeaway
A Coinbase data breach denial that rests on vendor boundaries leaves the notification duty, the regulatory filings and the phishing exposure with Coinbase regardless, which is why a Coinbase data breach is what customers will call it.
