Coinbase says user funds are safe after vendor exposes contact data

The Nasdaq-listed exchange said the incident occurred at analytics provider Amplitude and affected a small subset of customer information.

By Divyansh Mishra, YourKhabri DeskOct 28, 2026, 03:41 AM UTC2 min readCoinbaseSecurityData BreachAmplitude

Photo: Steve Jurvetson from Los Altos, USA, CC BY 2.0, via Wikimedia Commons

Key takeaways

1Coinbase confirmed a data incident at third-party analytics provider Amplitude on 28 October.
2The exchange said customer funds and core systems remain secure and unaffected.
3A small subset of customer contact information was exposed during the breach.
4Coinbase is notifying affected users and regulators by email as required by law.

Coinbase denied reports of a system breach on 28 October after a third-party vendor exposed a subset of customer contact information. The exchange said its own systems remain secure and that all customer funds are safe. It clarified that the incident originated at Amplitude, an analytics provider used by the company, rather than at the exchange itself.

According to a post from the Coinbase Support account on X, the exposed data includes contact details for a small group of users. This information was reportedly exposed alongside data from other Amplitude clients. Coinbase is the largest cryptocurrency exchange in the United States by trading volume and is listed on the Nasdaq.

The exchange uses third-party services like Amplitude to track how users interact with its mobile app and website to improve performance. This type of data collection is common among financial technology firms, but it creates what security analysts call supply-chain risks. These risks occur when a company core infrastructure is secure but its partners or vendors suffer a vulnerability.

Coinbase said it is notifying affected customers by email and has informed relevant regulators of the situation. The exchange did not specify the exact number of users impacted or the specific types of contact data involved in the leak. It said that its internal security systems have not detected any unauthorised access to its own servers or databases.

CoinDesk reported that while funds, passwords, and private keys were not compromised, exposed email addresses and phone numbers are valuable for attackers. This information can be used in phishing and social engineering attempts where criminals pretend to be exchange employees to steal login credentials. Users are advised to be cautious of unsolicited communications asking for account details.

The report comes as several financial firms in South Korea also disclosed customer data breaches this week. Daishin Securities reported that personal information belonging to 38,490 customers was accessed by hackers. The brokerage detected signs of unauthorised access last week and said the stolen data included names, email addresses, and mobile phone numbers.

The Bithumb exchange in South Korea also confirmed that some personal information of its customers was leaked in a cyberattack by an external party. Financial authorities in the country have begun an inspection into a separate data breach at Mirae Asset Global Investments. Coinbase has not suggested any link between its vendor incident and the events in South Korea.

Also reported by

Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.