Coinbase customers face renewed security concerns after an incident involving third-party analytics provider Amplitude exposed customer contact information.
The cryptocurrency exchange maintains that its internal systems remain secure and customer funds are safe.
However, conflicting estimates about the number of affected users have raised questions about the incident’s scale. The exposure also highlights phishing risks associated with compromised customer information.
Coinbase confirms Amplitude security incident affecting customer data
Coinbase confirmed late Tuesday, October 27, that a security incident at Amplitude affected a small subset of its customers.
The exchange clarified that attackers had not breached Coinbase’s internal systems. It also said the incident affected other Amplitude clients.
“Coinbase has not had a data breach,” the company’s support account stated on X.
Furthermore, Coinbase reported no evidence of unauthorized access to its infrastructure. The exchange also confirmed that customer funds remained unaffected.
Coinbase said it would notify affected customers and relevant regulators according to legal requirements.
However, the company did not disclose how many customers the incident affected. It also withheld details about the exposed information and the incident’s timing.
SlowMist executive claims over 70,000 Coinbase users affected
Meanwhile, blockchain security firm SlowMist raised concerns about the scale of the Amplitude incident.
Approximately 30 minutes before Coinbase’s statement, SlowMist chief information security officer 23pds shared additional claims on X.
According to 23pds, hackers obtained contact information belonging to more than 70,000 Coinbase users.
However, the executive said investigators had not confirmed whether attackers accessed passwords or stole customer funds.
Coinbase has not verified the 70,000-user estimate. Instead, the exchange maintains that the incident affected only a small subset of customers.
The conflicting statements leave the precise number of affected users unclear.
Although exposed contact details do not provide direct access to cryptocurrency wallets, criminals can exploit them through phishing campaigns.
Such information allows scammers to impersonate customer support representatives, distribute fraudulent links, and target individuals with convincing messages.
Coinbase data exposure revives earlier phishing concerns
The latest incident follows several security problems involving cryptocurrency platforms and customer information.
In August 2026, hardware wallet provider SafePal disclosed an access control vulnerability affecting approximately 39,798 customers.
The vulnerability exposed customer order information, creating opportunities for targeted fraud.
SafePal warned that scammers could exploit the information through fake support calls, fraudulent refunds, malicious software updates, and cloned websites.
Coinbase previously faced a separate customer data breach in May 2025.
During that incident, criminals bribed overseas customer support agents to obtain personal information belonging to selected users.
Coinbase said the attackers intended to impersonate the exchange and trick customers into transferring cryptocurrency.
The company allocated between $180 million and $400 million toward remediation and customer reimbursements.
It also announced a $20 million reward for information leading to arrests.
Separately, blockchain investigator ZachXBT estimated annual Coinbase-related scam losses at $300 million. In February 2025, he reported losses exceeding $65 million across two months.
In March 2026, SlowMist’s 23pds also criticized an official Coinbase Commerce page requesting users’ recovery phrases.
He described the practice as “extremely foolish,” warning against requesting mnemonic phrases to verify cryptocurrency assets.
