Coinbase Says Amplitude Leak Exposed Customer Data, Not Its Systems

Coinbase says a security incident at third-party analytics provider Amplitude exposed information belonging to some customers, but did not compromise the cryptocurrency exchange’s own systems or customer funds. The disclosure follows social media allegations that attackers obtained contact details for more than 70,000 users.

In a statement posted on X, Coinbase Support described the exposure as affecting a small subset of its customers, alongside customers of other Amplitude clients. The exchange said it had found no evidence of unauthorized access to Coinbase infrastructure and was notifying affected customers and regulatory agencies.

A Coinbase spokesperson provided additional detail to Unchained, saying the affected information included contact details and limited transaction data. The spokesperson said home addresses were not involved, nor was information that would enable someone to directly access customer accounts or funds.

The spokesperson also told Unchained that the claim involving more than 70,000 customers was false. Coinbase did not provide an alternative count, leaving the confirmed scale of the exposure unresolved despite its rejection of the figure circulating online.

Bitcoin.com News reported that accounts including DelCrxpto and SlowMist security executive 23pds had circulated the number. Those posts do not establish how many people were affected, and the distinction between an online allegation and a company-confirmed finding remains important to assessing the incident.

Amplitude supplies analytics technology that businesses use to understand engagement with digital products. The incident illustrates how customer information held by a service provider can be exposed without an attacker gaining access to the client company’s core platform. Coinbase’s assurances about its infrastructure therefore do not negate the separate exposure of customer data.

The immediate concern is the potential use of exposed information in impersonation attempts rather than a reported theft from the exchange. Contact details can help scammers construct convincing messages or fraudulent support calls designed to obtain credentials. That is a possible consequence of the leak, not evidence that such attacks have already succeeded in this case.

The disclosure also follows a separate incident Coinbase reported in May 2025, involving criminals who bribed overseas customer-support personnel to obtain user information. Coinbase refused a $20 million extortion demand and initially estimated remediation expenses and customer reimbursements at $180 million to $400 million. Those figures concern the earlier case, not the Amplitude exposure.

Important details about the vendor incident remain unavailable in the reporting reviewed, including when it occurred and how attackers gained access. Coinbase has not publicly identified the other Amplitude clients affected. Without those details, the available statements establish a customer-information exposure but do not support a complete assessment of its scope.

For now, Coinbase’s stated response centers on notifying customers and regulators while maintaining that its systems and customer funds were unaffected. Further disclosures from the exchange or Amplitude would be needed to clarify the number of people involved, the precise information exposed and the circumstances of the intrusion.