Coinbase Customer Data Exposed Via Analytics Vendor Amplitude Security Incident
Coinbase reports a security incident at its analytics vendor, Amplitude, exposing contact information for a subset of its customers, though Coinbase systems and funds remain unaffected.
Coinbase has announced that a security incident affecting its analytics vendor, Amplitude, has resulted in the exposure of contact information for a small portion of its customer base. The cryptocurrency exchange was quick to emphasize that its own systems and customer funds were not compromised, and that the breach was limited to data held by the third-party provider. This incident underscores the persistent risks associated with third-party vendor relationships, where a compromise at a partner can lead to data exposure even if the primary service remains secure.
While Coinbase has stated that no unauthorized access to its internal systems occurred, the incident at Amplitude has impacted a subset of Coinbase users. The exact number of affected customers has not been disclosed by Coinbase, nor has a definitive list of the specific data fields exposed. Initial reports have suggested email addresses and phone numbers, but Coinbase's official communication refers broadly to 'customer contact data.' This lack of precise detail leaves room for speculation, with some security researchers citing figures of over 70,000 affected users, though these numbers remain unverified by Coinbase.
The incident highlights the critical importance of third-party risk management in the cybersecurity landscape. Analytics vendors like Amplitude play a crucial role in helping businesses understand user behavior and product engagement. However, when customer data is shared with these external providers, their security posture directly influences the overall data protection strategy of the primary company. The Coinbase incident serves as a stark reminder that a secure primary platform does not guarantee the security of all associated customer data.
It is important to distinguish this incident from a previous data theft event involving Coinbase in May 2025, where attackers reportedly compromised customer information by bribing overseas support personnel. There is currently no known connection between that earlier breach and the current exposure via Amplitude. The current incident, based on available information, does not involve the compromise of passwords, private keys, or transaction records.
While the exposed contact data does not grant direct access to cryptocurrency wallets, it presents a significant risk for targeted phishing and social engineering attacks. Threat actors can leverage this information to craft highly convincing messages, impersonating Coinbase support to trick users into revealing sensitive credentials or transferring funds. The potential for follow-up fraud is the immediate concern, rather than a direct compromise of user accounts or assets.
Coinbase is in the process of notifying affected users and relevant regulatory bodies as required by law. The company advises customers to remain vigilant and to verify any security notices or communications through official channels, such as the Coinbase app or website, rather than relying on unsolicited links or messages. Coinbase's own security guidance emphasizes that its staff will never request passwords, verification codes, remote access, or ask users to send cryptocurrency to external addresses.
Further disclosures from Amplitude and Coinbase are anticipated to provide a clearer picture of the incident's full scope, the precise nature of the data involved, and the root cause. Until then, affected users are urged to exercise caution and monitor their communications for any suspicious activity, understanding that the primary risk lies in potential downstream fraudulent activities facilitated by the exposed contact information.