Coinbase customer data leaked again, but this time through a vendor. On Tuesday evening, Coinbase confirmed that a security incident at Amplitude, its analytics provider, exposed contact data for a small subset of its customers. Coinbase says its own systems were not breached and no funds were affected. SlowMist’s security chief puts the number of affected users above 70,000, a figure Coinbase has not confirmed.
Here is what leaked, what didn’t, and how to protect yourself from the phishing wave that usually follows.
What Happened at Coinbase
Rumors hit X first. On Tuesday, accounts started posting that hackers had stolen contact details for more than 70,000 Coinbase users. For almost three hours, Coinbase said nothing.
Then Coinbase Support responded. “Coinbase has not had a data breach,” the exchange wrote. Instead, it blamed Amplitude, a San Francisco analytics firm that tracks how people use apps and websites. According to Coinbase, the incident touched a small subset of its customer contact data. Other Amplitude clients were hit as well.
Coinbase added that it found no evidence of unauthorized access to its own systems. It is now emailing affected customers and notifying regulators, as the law requires. However, several key details are still missing. Coinbase hasn’t said how many customers were affected, which data fields leaked, or when the incident started.
What Data Was Exposed, and What Wasn’t
The exposed data is contact information. SlowMist’s CISO, who goes by 23pds on X, says hackers obtained email addresses and phone numbers for more than 70,000 users.
On the other hand, the leak did not include:
- Passwords
- Private keys or seed phrases
- KYC documents or ID photos
- Transaction history
- Customer funds
So nobody can log into your account or move your crypto with this data alone. The danger is what comes next.
Is This a Coinbase Data Breach?
Technically, Coinbase is right. Its systems were not breached. Amplitude’s were.
For customers, though, the difference barely matters. Your email and phone number left a company you never signed up with, because Coinbase shared it with them. Security teams call this third-party or supply-chain risk. Every vendor an exchange works with is one more place your data can leak from.
That is exactly why “Coinbase data breach” is trending today, despite the denial. From the user’s side, the result looks the same.
Coinbase’s Second Leak in 17 Months
This is not the first time. In May 2025, Coinbase disclosed that criminals had bribed overseas support contractors to steal customer data. That leak was far worse.
In total, 69,461 customers were affected. Stolen data included names, addresses, phone numbers, government ID images, partial Social Security numbers and masked bank details. The attackers then demanded a $20 million ransom. Coinbase refused, offered a $20 million bounty for information on the attackers instead, and promised to reimburse customers who lost money to resulting scams. It also estimated the total cost at $180 million to $400 million.
The two incidents work differently. Still, both show the same weak spot. Coinbase’s custody systems have never been breached. The data around them, however, keeps leaking.
Not Just Coinbase: A Week of Leaks
Coinbase wasn’t alone on Tuesday. In South Korea, three more firms disclosed incidents on the same day.
Bithumb confirmed unauthorized access to its internal employee groupware system. Employee names, work emails and phone numbers leaked. Meanwhile, the exchange is still checking whether customer data was involved.
Daishin Securities confirmed that personal and credit data for 38,490 customers was exposed. Names, emails, home addresses and account details were included.
Mirae Asset Global Investments detected unauthorized access to some web systems. So far, it says only internal business data was exposed.
According to South Korea’s Financial Supervisory Service, at least 16 financial firms faced cyberattacks in October alone. That adds up to roughly 100,000 data leak cases.
And last week, hardware wallet maker Keystone lost the home addresses of 25,964 buyers, plus its device verification key. We covered that one in the Keystone data breach post.
An email and phone number sound harmless. In crypto, they are the starting point for most scams.
Once scammers know you use Coinbase, their messages become far more believable. Expect three types of attacks:
Fake support calls. Someone calls claiming to be Coinbase security. They warn that your account is under attack and urge you to move funds to a “safe wallet.” That wallet belongs to them.
Phishing emails and texts. Messages copy Coinbase’s branding and even mention the Amplitude incident to look legitimate. The link leads to a fake login page.
SIM swaps. With your phone number, attackers try to take over your number at your carrier. If your account relies on SMS codes, that gives them a way in.
After the 2025 leak, this exact playbook cost Coinbase customers real money. So the next few weeks are the riskiest time.
How to Protect Yourself
Most of these attacks only work if you act on them. A few simple rules shut them down:
- Never move funds because someone told you to. Coinbase will never ask you to transfer crypto to a “safe” wallet.
- Never share a seed phrase or 2FA code. No real support agent will ask for either.
- Don’t call numbers from emails or texts. Open the Coinbase app yourself instead.
- Drop SMS two-factor. Switch to an authenticator app, a passkey or a hardware security key. Coinbase supports all three.
- Turn on address allowlisting. Withdrawals can then only go to addresses you approved in advance.
- Treat any message about the leak as suspicious. Scammers love using real news as bait.
Our stay safe guide covers these habits in more detail, from phishing links to wallet drainers.
Should You Still Use Coinbase?
Despite two leaks, Coinbase has never lost customer funds to a hack. It remains a US public company with audited financials and some of the strongest regulation in crypto. For many Americans, it is still the easiest way to move dollars into crypto.
However, it isn’t cheap, and personal data is clearly its weak spot. Our Coinbase review covers fees, safety and features in full. If you are weighing alternatives, our list of the best crypto exchanges in the USA is a good place to start.
For a decentralized option without KYC, see Hyperliquid vs Coinbase. Alternatively, MEXC vs Coinbase shows the opposite end of the fee scale.
Keep This Content Free
Breaking down a leak like this means sorting rumors from confirmed facts, hour by hour. We do that work for free. If this post helped, you can support the site by opening an account through our links:
Final Words
Coinbase says it wasn’t breached, and technically that holds up. Even so, customer emails and phone numbers leaked through Amplitude, just 17 months after the bribed contractor incident. No passwords, keys or funds were touched this time.
The real risk is the phishing that follows. So ignore unexpected calls, never move funds on someone else’s instructions, and switch away from SMS two-factor today. We will update this post once Coinbase or Amplitude confirms the final numbers.
FAQ
Did Coinbase have a data breach?
Coinbase says no. A security incident at its analytics vendor Amplitude exposed contact data for a small subset of Coinbase customers. Coinbase found no unauthorized access to its own systems.
How many Coinbase users were affected?
Coinbase hasn’t given a number. SlowMist’s security chief estimates more than 70,000 users, but Coinbase has not confirmed that figure.
What data was leaked in the Amplitude incident?
Contact information, reportedly email addresses and phone numbers. Passwords, private keys, KYC documents and funds were not affected.
Is my crypto on Coinbase safe?
According to Coinbase, customer funds were not impacted. The main risk is phishing and fake support calls that use the leaked contact details.
Has Coinbase been hacked before?
Coinbase’s custody systems have never been hacked. However, in May 2025, bribed support contractors stole personal data from 69,461 customers, and attackers demanded a $20 million ransom.
How do I know if I was affected?
Coinbase is emailing affected customers. Still, be careful: scammers may send fake “breach notification” emails too. Check your account directly in the Coinbase app rather than clicking any links.
Credit: Source link
