Coinbase denies a data breach. In a post on its official support account on X, time-stamped 02:49 UTC on Wednesday 28 October (late Tuesday evening in New York), the exchange said a security incident at Amplitude, an analytics company it uses, exposed contact details belonging to a small group of Coinbase customers. Coinbase said it found no sign that anyone got into its own systems and that customer funds were not touched. It did not say how many people are affected, which contact details leaked or when the incident happened, according to CoinDesk, which reported the post shortly after 03:00 UTC.
That distinction matters to Coinbase, which spent much of 2025 dealing with an insider data theft. It matters less to a customer whose e-mail address or phone number is now in someone else’s hands. A list of people known to hold a Coinbase account is the raw material for fake “Coinbase security” messages, and Coinbase’s own help pages describe exactly how those scams work.
What Coinbase said about the Amplitude incident
The statement is short. “Coinbase has not had a data breach,” the support account wrote, according to Cryptonews, which quoted the post. The incident, Coinbase said, started at Amplitude and also hit other Amplitude customers, not Coinbase alone. CoinDesk reported that the data concerned a “small subset” of customers’ contact information and that Coinbase is e-mailing the people affected.
The exchange also said it is notifying impacted customers and regulators in line with its legal obligations. It named neither the regulators nor the countries.
Amplitude is a product analytics service: companies send it records of how people use their apps and websites, so that they can study sign-ups, clicks and drop-offs. Such tools often receive an identifier for each user, and sometimes an e-mail address. The exchange has not said what it shared with Amplitude or why contact data was in the vendor’s systems.
What leaked, and what Coinbase and Amplitude have not said
As of about 06:30 UTC on 28 October, the known facts fit in two lines: contact data, a small subset of customers. Everything else is open.
- The number of Coinbase customers affected. Coinbase gave no figure, and CoinDesk said it had not disclosed one. Figures circulating on smaller sites are not confirmed by Coinbase or Amplitude, and we do not repeat them.
- The fields. “Contact data” could mean e-mail addresses, phone numbers, names or a mix. Coinbase did not specify.
- The dates. Neither company has said when the Amplitude incident began, when it was found or how long it lasted.
- Which customers. Nothing published says whether customers in the European Union or the United Kingdom are included, or only US accounts.
- Amplitude’s version. Amplitude, listed on Nasdaq as AMPL, had published nothing on the incident when we checked on the morning of 28 October: no post on its blog, no notice on its public trust centre, and no filing with the SEC since an 8-K on 15 October about a change among its officers. CoinDesk’s report carried no comment from the company.
No passwords, private keys or funds were reported compromised, CoinDesk noted. Contact data on its own cannot move money out of an account. What it can do is tell a fraudster whom to call and which brand to pretend to be.
Why a list of Coinbase customers is valuable to scammers
The exchange has already explained this in its own words. When it disclosed the 2025 insider theft, it wrote on its blog that the criminals’ aim was “to gather a customer list they could contact while pretending to be Coinbase”. That post, dated 15 May 2025, describes a method that does not need any hacking of the victim: a phone call or message that sounds official, a story about a compromised account, and a request to move funds somewhere “safe”.
A leaked contact list makes those calls cheaper to run. The scammer no longer has to guess who holds crypto, or on which platform. That is why the phishing risk outlives the incident itself, even when no account is touched. We saw a similar pattern two days ago, when phishing e-mails reached Passport wallet owners through a compromised mail setup, and on Tuesday with a tampered support-chat script that swapped deposit addresses.
The May 2025 Coinbase breach: a different case, and a bigger one
Many customers will think of May 2025 first. That time, the data was taken from inside Coinbase. According to the company’s Form 8-K filed with the SEC (report dated 14 May 2025), an unknown actor e-mailed Coinbase on 11 May 2025 claiming to hold customer data and demanding money not to publish it. Coinbase refused.
The blog put a number on the demand: “Instead of paying the $20 million ransom, we’re establishing a $20 million reward fund,” money meant to help bring those responsible to arrest and conviction. The data was copied by a small group of overseas support agents who had been paid off; Coinbase said it fired them. The blog put the affected group at less than 1% of Coinbase’s monthly transacting users.
| May 2025 insider theft | October 2026 Amplitude incident | |
|---|---|---|
| Where it happened | Coinbase’s own customer support tools, via bribed overseas agents | Amplitude, a third-party analytics vendor |
| Data concerned | Name, address, phone, e-mail, last 4 digits of SSN, masked bank details, ID images, balances and transaction history | “Contact data”, fields not specified |
| Customers affected | Less than 1% of monthly transacting users (Coinbase blog) | “A small subset”, no number given |
| Extortion | $20 million demanded, refused; $20 million reward fund | None reported |
| Cost estimate | About $180 million to $400 million (8-K) | None given |
| Passwords, keys, funds | Not compromised (8-K) | Not compromised, according to Coinbase |
The 8-K put the cost of remediation and voluntary reimbursements at roughly $180 million to $400 million, a preliminary range. Coinbase also said in 2025 that it would reimburse retail customers who had been tricked into sending funds to the scammers as a direct result of that incident, after review. It has made no comparable statement about the Amplitude case, and there is no reported loss to compensate yet.
On the information available, the 2026 exposure looks narrower: contact details rather than ID documents and balances. That is a reading of the company’s own words, not a confirmed scope, and it could change once the number and the fields are published.
How to spot a fake Coinbase message after the Amplitude leak
Whether or not your address was in Amplitude’s data, the advice is the same, and it comes from Coinbase’s help centre rather than from us. Its page on technical support and impersonation scams says that no one will ever ask for your password, your 2FA codes, “or for you to transfer assets to a specific or new address, account, vault, or wallet”.
The same page lists what Coinbase customer service agents will never do:
- ask you to secure, move or access your funds;
- give you a wallet seed phrase or ask you for yours;
- ask for your password or 2-step verification code;
- ask you to install software on your device, or take remote control of it to act on your account.
If any of that happens, Coinbase tells customers to end the call and write to [email protected]. It also warns that scammers can spoof real phone numbers on outgoing calls, so a familiar number on the screen proves nothing.
Checking an e-mail that claims to come from Coinbase
A real notice about the Amplitude incident may well arrive, since Coinbase says it is contacting affected customers. Coinbase’s page on its e-mail addresses says not to trust the display name, or even the sender address on its own, because both can be faked. It lists the domains genuine messages come from: coinbase.com, mail.coinbase.com, updates.coinbase.com, info.coinbase.com and cb.mail.coinbase.com.
The safer habit is the one the page recommends: do not click links in the message. Open the Coinbase app, or type coinbase.com into a new tab, and check whether anything needs doing. Typical signs of a fake, according to the same page, are an invented case number, an alert about suspicious activity meant to rush you, and a link to a “secure portal”.
Settings Coinbase recommends
Two settings on Coinbase’s list are worth a look now that phone numbers may be among the leaked details. The first is strong two-factor authentication: “Hardware keys are best,” the help page says, which also keeps an SMS code out of the picture if a fraudster tries to take over your phone number. The second is withdrawal allow-listing, which limits on-chain transfers to wallets you already know and trust.
If something feels wrong, Coinbase’s advice is to lock the account first, in the app, and ask questions afterwards. A seed phrase, in any case, should never leave your hands: our guide to keeping a recovery phrase safe explains why no genuine support agent needs it.
European customers and the 72-hour rule
For readers in the EU, the GDPR sets the frame. Article 33 requires the controller, the company that decides why and how the data is used, to notify its data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to put people’s rights and freedoms at risk. Article 34 adds a duty to tell the people concerned, again without undue delay, when the breach is likely to result in a high risk to them. Paragraph 2 of article 33 covers vendors: a processor, which handles data on a client’s behalf as analytics services usually do, must alert that client without undue delay once it becomes aware of a breach.
Coinbase serves European customers through its Irish entity, which was fined €3.25 million by the Central Bank of Ireland last week over a separate client-money issue. Whether any EU or UK customers are in the Amplitude data is not known. Coinbase’s post speaks of “regulatory agencies” without naming one, and no European authority had commented when this piece was written.
What to watch next
The missing number comes first: how many Coinbase customers are in the data, and in which countries. Then Amplitude’s own account of what happened and which other clients were hit, which had not appeared by the time of publication. A third thing to watch is whether Coinbase, a listed company, files anything about the incident with the SEC, as it did within days in May 2025.
For customers, the practical point does not depend on any of that. Exchanges hold your contact details as part of the account, and so, it turns out, can the vendors they work with; our explainer on how centralized exchanges work covers what a platform keeps about you. A message that asks you to move funds, read out a code or hand over a recovery phrase is a scam, whatever name it carries.
1 comment