Coinbase Identifies Third-Party Data Exposure
Coinbase has disclosed that some customer contact information was exposed in a security incident involving Amplitude, an analytics provider used by businesses to understand user activity. The incident affected a “small subset” of Coinbase customers, as well as customers of other Amplitude clients.
In a statement published on X on Wednesday, Coinbase Support addressed the incident and distinguished the vendor-related exposure from a breach of Coinbase’s own infrastructure. The exchange said it had found no evidence that its internal systems had been compromised.
Coinbase also stated that customer funds were not affected. The available information does not specify the exact number of Coinbase customers involved or identify every category of contact information exposed. The incident therefore should not be interpreted as confirmation that account credentials, private keys, or financial assets were compromised.
How a Third-Party Security Incident Can Affect Customers
Cryptocurrency exchanges rely on external service providers for functions such as analytics, customer support, infrastructure, and business operations. These integrations can create security risks if a vendor experiences unauthorized access or exposes information associated with its clients.
Amplitude provides analytics services that help organizations examine how users interact with digital products. When customer-related information is processed through a third-party platform, a security incident at that provider can affect an exchange’s users even if the exchange’s own systems remain secure.
Coinbase’s disclosure highlights the importance of distinguishing between a direct platform breach and an incident involving an external provider. The two scenarios can expose different types of information and create different levels of risk. In this case, Coinbase attributed the exposure to Amplitude and said it found no evidence of unauthorized access to its own systems.
Coinbase Says Customer Funds Were Not Affected
The exchange’s statement provides two important points for customers: the incident involved contact information, and Coinbase said customer funds were unaffected. However, the available disclosure does not provide a complete technical account of the incident or confirm the precise scope of the exposed information.
Contact data can still create risks even when funds and account balances remain secure. Exposed information may be used in targeted phishing attempts, impersonation, or fraudulent communications designed to persuade customers to reveal sensitive information.
Customers should be cautious with messages claiming to come from Coinbase, particularly those requesting passwords, authentication codes, wallet recovery phrases, or transfers of cryptocurrency. Users should access their accounts through official channels rather than through links in unexpected messages. Coinbase customers can consult the company's official website for account access and support resources.
Incident Comes Amid Other Reported Data Security Concerns
The disclosure came as other financial businesses faced separate security-related concerns. In South Korea, cryptocurrency exchange Bithumb was investigating whether a breach involving its internal work platform had exposed customer information. Brokerage firm Daishin Securities also reported a leak involving personal and credit information belonging to 38,490 customers.
These incidents involve different organizations and circumstances. The available information does not establish that they are connected to the Amplitude incident or that they share the same cause. They nevertheless illustrate how information security risks can affect both cryptocurrency platforms and traditional financial businesses.
For digital asset companies, protecting customer information extends beyond securing wallets and blockchain transactions. Organizations must also assess the security practices of vendors that process customer data, limit unnecessary access, and communicate clearly when an incident occurs.
Coinbase Previously Disclosed a Separate Data Breach
The latest disclosure follows a separate Coinbase data breach announced in May 2025. At that time, the company said the incident affected less than 1% of its monthly transacting users and estimated reimbursement and remediation costs at up to $400 million.
The earlier incident is distinct from the Amplitude-related exposure. The information provided does not establish that the two events involved the same attackers, vulnerabilities, or data. Their relationship should therefore not be assumed simply because both incidents involved Coinbase customers.
The latest incident also remains limited in scope based on the details publicly provided. Coinbase denied that its own systems were breached, but the precise number of affected customers and the full categories of exposed information were not specified in the supplied disclosure.
What Coinbase Customers Should Watch For
Customers should watch for suspicious emails, text messages, and social media messages that refer to the incident or claim that immediate action is required. Attackers may use a genuine security announcement to make fraudulent messages appear more credible.
Users should never share account passwords, two-factor authentication codes, or wallet recovery phrases in response to unsolicited communications. They should also avoid downloading unexpected attachments or connecting wallets to unfamiliar websites. Any account-related concerns should be handled through official Coinbase support channels.
Further clarification from Coinbase or Amplitude would help establish the number of affected users, the exact data involved, and any additional protective steps recommended for customers. Until those details are available, the confirmed information remains that a third-party analytics incident exposed some contact data, while Coinbase reported no evidence of a breach of its own systems and no impact on customer funds.
