Coinbase reports data exposure at Amplitude, with no intrusion found in its systems

An incident at the analytics provider

Coinbase said on October 28, 2026, that a security incident at Amplitude, its analytics service provider, had exposed contact information concerning a small subset of its customers. Other customers of the vendor were also affected, according to Coinbase Support's message. The platform says it has found no evidence of unauthorized access to its own systems. That attribution must be retained: this is the state of findings communicated by the company, rather than an independently published assessment covering its entire infrastructure.

Coinbase also says customer funds are unaffected, according to its statement reported by Cointelegraph. The exact number of people involved, the complete list of exposed information and the incident's technical details are not specified in the material reviewed. Those gaps rule out inferring a victim count or financial loss. Nor do they justify extending the announced scope to every account on the platform or every Amplitude user.

Exposed contact details and assets are separate matters

A contact-information leak and access to tools that can move cryptocurrency do not describe the same event. Contact details can nevertheless make a fraudulent message using a familiar service's name appear more credible. That risk explains why checking incoming requests remains useful even when the company reports no impact on funds. A promise to secure assets accompanied by a mandatory transfer should be assessed by what it actually asks, rather than only the identity it displays.

In its help center, Coinbase says its agents do not ask for passwords, verification codes or recovery phrases. They also do not ask users to send cryptocurrency to an external address to protect it. These are general prevention guidelines, not evidence that a particular campaign has already exploited the Amplitude incident. The appropriate place to check remains the official application or website opened directly, rather than a number or link supplied in an unexpected solicitation.

Details still needed on the actual scope

The announcement should not be confused with the separate incident Coinbase disclosed in May 2025. The affected-person figures and cost estimates associated with that older case do not automatically describe the Amplitude event. Reusing those amounts under an October headline would give the new information an unestablished scale. Tracking this case requires details specific to it: data categories, the period involved and any notifications sent to identified users.

For customers, the practical distinction is therefore to protect access while avoiding decisions dictated by an unverified contact. The help center recommends strong authentication and official support contact channels, among other measures. The October 28 communication establishes data exposure at a supplier and Coinbase's position on its systems and funds. It announces neither reimbursement, widespread losses nor demonstrated access to private keys: those elements should not be added to the account.