Coinbase Denies Internal Breach as Amplitude Security Incident Hits User Contact Info

A Coinbase data breach claim surfaced on October 28, 2026, after SlowMist CISO 23pds (@im23pds) posted that hackers had accessed contact information for more than 70,000 users.

Coinbase pushed back quickly. The exchange confirmed that it had “not had a data breach”, pointing instead to a security incident at its analytics vendor, Amplitude, which affected a small subset of Coinbase customer contact data alongside records from other Amplitude clients.

Ad

Ad

What Happened, And What Did Not

Coinbase Support confirmed via X that no unauthorized access to Coinbase systems occurred. Customer funds, passwords, and private keys were not impacted. The company said it is notifying affected users and regulators, as required by law.

Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and customer…

— Coinbase Support (@CoinbaseSupport) October 28, 2026

The distinction carries weight. The 2025 insider incident, which involved bribed TaskUs support agents and affected roughly 69,461 users, drew a DOJ investigation and exposed far deeper personal data, including names, addresses, and phone numbers.

That earlier incident had estimated remediation costs of $180–400 million. By contrast, the Amplitude incident appears limited to contact fields such as emails and phone numbers.

That breach also reached high-profile targets. Sequoia Capital’s Roelof Botha was among those affected, a detail that underscored how the hack hit high-profile executives.

Coinbase has since moved to shore up its security posture. It is building post-quantum custody for the $250 billion it holds for BlackRock and other institutions, signaling how seriously it now treats infrastructure risk.

Even so, exposed contact data carries real danger. Phishing and social-engineering campaigns followed the 2025 breach. The same risk applies here.

Users are advised to watch for unsolicited calls or emails impersonating Coinbase Support.

Ad

Ad

Supply-Chain Risk Grows as Coinbase Expands

The Amplitude incident arrives at a sensitive moment. The same month saw Coinbase restrict 14 crypto assets for European retail customers to meet MiCA requirements, giving EEA users just three days to withdraw before automatic conversion.

The exchange has simultaneously ramped up political spending ahead of the 2026 midterms.

Coinbase has donated roughly $58 million this cycle, ranking fifth among all corporate donors, one of crypto’s top donors in the midterm elections.

Security researchers at SlowMist have been flagging third-party risk loudly in recent weeks.

The firm issued warnings after critical PHP vulnerabilities emerged that threatened crypto exchange frontends, prompting crypto firms to clarify their PHP exposure.

Now, the same firm is at the center of a Coinbase data breach disclosure, reinforcing a broader point: third-party vendors remain the weakest link for exchanges that have hardened their own infrastructure.

Coinbase has also cut lobbying spend after the Clarity Act’s Senate defeat, a sign of shifting regulatory strategy.

The combination of regulatory pressure, expansion ambitions, and now another Coinbase data breach headline, even a limited one, tests investor confidence in COIN at a critical time.