Coinbase Customer Data Hit in Analytics Vendor Breach, Funds ‘Not Impacted’

What it is

On 28 October 2026, Coinbase Support said on X that Amplitude, a third-party analytics provider, had a security incident affecting contact data of a "small subset" of Coinbase customers. Other Amplitude customers were also affected, and Coinbase did not name them. Coinbase said it has "not had a data breach", found no evidence of unauthorized access to its systems, and that funds were "not impacted". It is notifying affected customers and regulators in line with its legal obligations.

Caveats

Coinbase gave no customer count, no data types and no incident dates. Its statement is the only source, and the page reports no independent confirmation or statement from Amplitude.

Related partner exposures the page cites

• Trezor: in September 2026, Trezor said a breach at shipping provider ShipMonk exposed names, phone numbers and home addresses of 67,000 U.S. customers, on top of nearly 14,000 disclosed in August. Some records dated to 2019, years after ShipMonk had told Trezor they were deleted.
• Trezor warned affected customers to watch for fake emails, calls and letters, and about risks to their physical security.
• Cybercrime consultant David Sehyeon Baek told Decrypt that a letter with a name and home address signals "we can locate you", and that such data stays useful for years because people rarely move or change numbers.
• Coinbase, May 2025: bribed overseas support agents stole data on under 1% of monthly transacting users. Coinbase refused a $20 million ransom and offered a $20 million bounty. A Maine attorney general filing put the count at 69,461, with names, addresses, masked Social Security numbers and government ID images exposed.