Coinbase's Amplitude Data Incident Explained: What Was Exposed & Are You Affected?

 

Coinbase responded on October 27, 2026 US time to a security incident at Amplitude, a third-party analytics provider. Per its public statement, the incident involved contact information for a small subset of customers, its investigation "found no evidence of unauthorized access to Coinbase's internal systems," customer funds were unaffected, and the company is notifying affected customers and regulators as required by law.

 

In discussing an incident of this kind, sorting the information into three categories is more useful than restating headlines.

 

Publicly stated by Coinbase: the incident originated at third-party analytics provider Amplitude, involved contact information for a small subset of Coinbase customers, and also involved data belonging to other companies using the same service.

 

Asserted by Coinbase but not independently verified: that its own systems were not breached, that no unauthorized access was detected, and that customer funds are safe. All three come from the company's own account and have not been independently verified.

 

Still undisclosed as of this article's verification point: the exact number of affected customers, the full list of exposed data fields, when unauthorized access began and when it was discovered, how attackers obtained the data, Amplitude's own technical account, the identity of other affected companies, and whether the data has spread further.

 

One figure warrants an early flag: a security firm has reportedly said more than 70,000 users were affected, while Coinbase has neither confirmed that figure nor published its own count. That number sits very close to the affected total in a separate, confirmed incident from May 2025, making the two easy to conflate, and the second section addresses this specifically.

 

This article organises the incident along those three boundaries, explains why contact information exposure deserves serious attention in this particular context, and sets out concrete methods for verifying notifications.

 

 

 

Coinbase says the incident originated with a third-party vendor rather than a breach of its own systems. The company states it found no evidence of unauthorized access to internal systems, an account provided by the company itself.

 

The data involved is contact information, reportedly including email addresses and phone numbers. Coinbase has not published a full list of exposed fields.

 

Coinbase says customer funds were unaffected. The company also says it is notifying affected customers and regulators as required by law.

 

The figure of more than 70,000 comes from a third-party security firm and is unconfirmed by Coinbase. That number sits close to the total in a different incident from May 2025, inviting confusion.

 

The incident timeline is entirely undisclosed. That includes when access began, when it was discovered, the method used, and whether the data has spread.

 

Amplitude has yet to provide a detailed public technical account. Since data belonging to other companies using the same service was involved, the actual scope may extend beyond Coinbase alone.

 

The real risk is support impersonation and account recovery scams rather than direct account theft. Per Coinbase's account, the exposure does not involve passwords, recovery phrases or funds.

 

 

Only one point in the timeline is currently established: Coinbase responded publicly through its official support account on October 27, 2026 US time, with coverage published that evening.

 

Everything else about the timeline is undisclosed. Public information gives no date for when unauthorized access began, when Amplitude or Coinbase discovered the problem, or how attackers obtained the data, nor does it state whether the data has since been circulated further or surfaced anywhere.

 

That disclosure state is itself worth noting. Security incident disclosure typically proceeds in stages, with an initial statement focused on scoping and reassurance while details follow as the investigation progresses. So the current information gaps do not imply concealment, but they do mean any definitive conclusion about precisely what was exposed is premature.

 

The table below organises the information by reliability, which is the reading approach this article recommends.

 

 

On passwords and private keys, a basis note is needed. Some reporting states that the exposure does not include passwords, private keys or funds, but that formulation appears conditionally in the original reporting and is not clearly attributed to a formal Coinbase statement. So until Coinbase publishes a full field list, the safer approach is to treat "passwords and private keys unaffected" as unconfirmed rather than confirmed, and to handle account security on the most conservative basis.

 

 

This section carries what this article considers the most practically valuable warning right now.

 

Security firm SlowMist has reportedly said more than 70,000 Coinbase users were affected. Coinbase has neither confirmed that figure nor published its own count or counting basis.

 

Separately, Coinbase disclosed an entirely different data breach in May 2025 affecting almost 70,000 customers.

 

 

The two incidents carry very similar affected counts with entirely different natures, and they also differ in reliability: the almost 70,000 from May 2025 was disclosed by Coinbase itself, while the more than 70,000 from October 2026 comes from a third-party firm and is unconfirmed by the company.

 

That means secondary coverage over the coming days will quite likely mix details from the two, for instance applying the May 2025 exposure scope of "names, addresses, ID records" to this incident, or describing this one as Coinbase again exposing identity information for 70,000 people. Neither formulation currently has any basis.

 

One unresolved discrepancy also needs noting. Coinbase describes the scope as a small subset of customers while the third-party figure is more than 70,000. Given that Coinbase's total user base runs into the tens of millions, 70,000 could indeed constitute a small subset, so the two characterisations are not necessarily contradictory, but the gap between them cannot be reconciled until the company publishes a specific count.

 

 

Per Coinbase's account, this incident does not involve passwords, recovery phrases or funds, so the risk is not direct account theft. The real risk path is social engineering, and Coinbase customers have a specific history along that path.

 

After the May 2025 incident, exposed customer information was used in targeted social engineering attacks, and Coinbase ultimately estimated remediation and voluntary reimbursement costs at between $180 million and $400 million. That figure itself demonstrates the value of contact information: attackers do not need a password, only to know who you are, which email you use, your phone number, and which platform holds your account.

 

This incident also carries an additional disadvantage of timing. Coinbase says it is emailing affected customers, and attackers know that too. That means users will spend the coming period expecting a security notification email from Coinbase, and that expectation is itself the single most effective precondition for a phishing attack. A forged data breach notification carries far more credibility right now than it would ordinarily.

 

Given that the exposure consists of contact information, the inferable attack patterns concentrate into three forms, which is also how security advisories typically summarise them.

 

Unsolicited contact impersonating support. An attacker contacts users by email or phone claiming to be the platform's security team, saying the account is at risk because of this incident and requires cooperation with verification or transfer to a secure address. The identifying test is that any contact requesting a password, recovery phrase or two-factor code is a scam, and Coinbase has previously stated plainly that its support staff will never request this information.

 

Forged breach notifications. Exploiting the fact that users are awaiting an official notification, these send emails containing links that direct to a counterfeit login page. The identifying test is not entering an account through a link in an email.

 

Account recovery scams. Using known email addresses and phone numbers, these attempt to trigger or forge an account recovery process. The identifying test is treating any recovery request you did not initiate yourself with suspicion.

 

For the full set of methods for identifying these patterns, see our guide to protecting yourself from common scams.

 

 

The structural implication of this incident matters more than the consequences for any single platform.

 

Coinbase states that the incident also involved data belonging to other companies using the same Amplitude service, without naming them. And per current reporting, Amplitude has yet to provide a detailed public technical account.

 

Amplitude is a widely used product analytics provider whose clients span a large number of consumer applications. That means an incident occurring at the analytics provider level may have a scope far exceeding what any single client can disclose, while each affected company typically discloses only the portion relating to its own customers.

 

That creates a practical problem: users cannot determine whether they are affected by following any one platform's announcements, since they may simultaneously be users of several applications relying on the same service. Until Amplitude publishes a complete list of affected clients, that scope cannot be established.

 

It should be noted that third-party analytics services typically touch product usage behaviour and basic account identifiers rather than passwords, private keys or transaction authority, which is consistent with Coinbase's account that funds were unaffected. But contact information alone is sufficient to support the social engineering attacks described above, so not having reached core credentials does not equate to no risk.

 

Note also that other data breach reports circulated over the same period, independent of this incident, involving Daishin Securities in South Korea (38,490 customers), Bithumb, and a regulatory inspection at Mirae Asset Global Investments. These have no reported connection to the Coinbase Amplitude incident and should not be described together, though collectively they indicate recent pressure on the data surface of trading platforms and their vendors.

 

 

Based on what is currently known, the reasonable responses are limited in number and specific. Excessive procedural advice increases the chance of error instead.

 

First, wait for official notification but do not act through links within it. Coinbase says it will email affected customers. On receiving any such email, do not click the links inside it; instead enter the platform address in a browser yourself or log in through the official app to view notifications inside the account. This point matters considerably more than usual at present, for the reason given above.

 

Second, treat any unsolicited contact with default suspicion. Whatever platform a call, text or email claims to represent, one test governs: anything requesting a password, recovery phrase or two-factor code is a scam. A platform's support staff do not need that information to assist you.

 

Third, do not rush to move assets because of this news. Moving funds to a secure address is among the most common scripts in this category of scam. Per Coinbase's account this incident does not involve funds or credentials, so there is no technical reason for urgent transfers, and acting in a state of panic is exactly what an attacker wants.

 

Fourth, verify the official channels of the platforms you use. The direct consequence of contact information exposure is that impersonators know how to reach you, so establishing in advance which channels are official is more reliable than judging the authenticity of individual messages after the fact. MEXC users can verify official channels through MEXC Verify to confirm whether a message, support account or link genuinely comes from MEXC. Instructions for the tool are in the usage guide.

 

Fifth, follow subsequent disclosure rather than repeated secondary coverage. Only a few pieces of new information will genuinely change the assessment: the exact count and field list Coinbase publishes, Amplitude's technical account and complete list of affected clients, and any regulatory notice. Coverage beyond those is mostly a restatement of the same material.

 

 

For James Mitchell, the part of this story most worth recording is not what was exposed but what remains unknown, and what will fill that gap.

 

Everything substantive currently known comes from Coinbase's own account: a third-party vendor incident, contact information for a small subset of customers, no unauthorized access detected on its own systems, funds safe. The last two of those four are the company's own account and have not been independently verified. Meanwhile six items remain entirely blank: the affected count, specific fields, timeline, attack method, Amplitude's technical account, and other affected companies. In that state, any report claiming to have established what was exposed is reaching beyond what can be verified.

 

I particularly want to flag the 70,000 figure. A third-party security firm says this incident affected more than 70,000 users, unconfirmed by Coinbase. The May 2025 incident, disclosed by Coinbase itself, affected almost 70,000. The two numbers are nearly identical, the incidents entirely different in nature, and the reliability of the two figures differs. I am close to certain that coverage conflating the two will appear within days, typically by applying the 2025 exposure of names, addresses and ID records to this contact information incident, producing a conclusion considerably more severe than the facts support. On reading any specific field description about this incident, establish first which incident it is citing.

 

On the real shape of the risk, the 2025 incident provides the most persuasive reference. That exposure was also not passwords and private keys, yet Coinbase ultimately estimated remediation and voluntary reimbursement at between $180 million and $400 million. That figure demonstrates something counterintuitive: an attacker does not need your credentials, only to know who you are, which platform holds your account, and how to reach you. Social engineering handles the rest. So the statement that no passwords were exposed is true, and it is not grounds for relaxing.

 

This incident carries one timing problem worth isolating. Coinbase says it will email affected customers, and attackers obviously know that as well. So for the coming period users sit in a state of awaiting a security email from their platform, which is precisely the condition under which phishing succeeds most often. A forged breach notification carries far more credibility now than usual. Which is why the most important item in my advice is a plain one: on receiving a notification, do not click the links inside it, and enter the account yourself through a browser or the app. That holds at any time, and it is especially critical over the next fortnight.

 

A closing word on the structural problem of vendor risk. What failed here is an analytics provider, and Coinbase states explicitly that companies using the same service were also involved. Amplitude has still given no detailed public technical account and published no complete list of affected clients. That means an ordinary user cannot confirm whether they are affected by watching any one platform's announcements, since they may be a user of several applications relying on the same service. Risk from shared dependencies of this kind is pervasive in consumer applications and rarely perceptible to users. A single platform perfecting its own security cannot eliminate that layer. This is not an excuse for any party, but an explanation that in incidents of this type, the part a user controls is mainly how they handle unsolicited contact rather than how the data itself is protected.

 

 

 

Per Coinbase's public statement, the incident involved contact information for a small subset of customers, with third-party reporting indicating this includes email addresses and phone numbers. But Coinbase has not published a full list of exposed fields, so precisely what was included remains undetermined. The company also states the incident involved data belonging to other companies using the same Amplitude service, without naming them.

 

 

Coinbase says customer funds were unaffected. Note that this is the company's own account and has not been independently verified by a third party. Some reporting states the exposure does not include passwords or private keys, but that formulation appears conditionally in the original reporting and is not clearly attributed to a formal Coinbase statement, so until the company publishes a full field list the safer approach is to treat it as unconfirmed and handle account security on the most conservative basis.

 

 

Coinbase has not published a count, describing the scope only as a small subset of customers. A security firm has said more than 70,000 users were affected, but Coinbase has not confirmed that figure. Note that this number sits very close to the affected total in a different incident from May 2025, almost 70,000, making the two easy to conflate, while the former comes from a third party and the latter was disclosed by Coinbase itself, so their reliability differs.

 

 

No, the two are entirely different in nature. The May 2025 incident involved criminals bribing overseas support contractors and employees to obtain customer records, exposing names, addresses, ID records and account details, with passwords and private keys confirmed not compromised; Coinbase estimated remediation and voluntary reimbursement at $180 million to $400 million and rejected a $20 million extortion demand. The October 2026 incident originated at third-party analytics provider Amplitude and involved contact information. Reporting states explicitly that these are separate incidents.

 

 

Four things principally. Wait for official notification but do not click links in the notification email, instead entering your account yourself through a browser or the official app. Treat any unsolicited contact with default suspicion, since anything requesting a password, recovery phrase or two-factor code is a scam. Do not rush to move assets because of this news, since moving funds to a secure address is a common script in this category of scam and per Coinbase's account this incident involves neither funds nor credentials. And establish in advance which channels for the platforms you use are official.

 

 

Because the attack path is social engineering rather than direct account theft. An attacker does not need a password, only to know who you are, which platform holds your account and how to reach you, with the rest handled through support impersonation, forged notifications and account recovery scams. The May 2025 incident likewise did not expose credentials, yet Coinbase ultimately estimated related costs at between $180 million and $400 million, which demonstrates the practical value of this category of data.

 

 

Possibly, but the scope is undetermined. Coinbase states the incident involved data belonging to other companies using the same Amplitude service, while Amplitude has still given no detailed public technical account and published no complete list of affected clients. Since analytics providers are used by large numbers of consumer applications, the actual scope may exceed what any single platform discloses, and users cannot confirm whether they are affected by following one platform's announcements alone.

 

 

Only a few pieces of new information will genuinely change the assessment: the exact affected count and complete field list Coinbase publishes, Amplitude's technical account and list of affected clients, and any regulatory notice. Also relevant are when unauthorized access began and when it was discovered, how attackers obtained the data, and whether the data has spread further. Coverage beyond these is mostly repeated restatement of the same material.

 

 

The information above is provided for general informational reference only and does not constitute investment advice, financial advice, legal advice, a security consulting service, or any assessment of the security posture of any platform. This article is compiled from reporting and corporate public statements available before 17:00 Singapore time on October 28, 2026; the matter remains ongoing and subsequent disclosure may change parts of this article. Information is labelled throughout by source and reliability: content identified as publicly stated by Coinbase comes from that company's own account; content identified as asserted by Coinbase, including that its internal systems were not subject to unauthorized access and that customer funds were unaffected, is the company's own account and had not been independently verified by a third party as of the verification point; content identified as third-party reporting or a third-party firm's claim, including the involvement of email addresses and phone numbers and the figure of more than 70,000 affected users, has not been confirmed by Coinbase; items identified as undisclosed indicate missing information from which no specific content should be inferred. Coinbase has not published a complete list of exposed fields, and the formulation regarding whether passwords and private keys were involved appears conditionally in the original reporting without clear attribution to a formal company statement, so readers should not treat it as established fact. This incident and the data breach Coinbase disclosed in May 2025 are separate incidents whose affected counts are similar but whose sources and reliability differ, and their details should not be mixed. Amplitude had given no detailed public technical account as of the verification point and no complete list of affected companies has been published, so the actual scope cannot be determined. Other data breach reports referenced have no reported connection to this incident. The protective measures described are a summary of general security practice, do not address any individual's specific circumstances, and do not guarantee protection against all attack patterns; specific account security settings should follow each platform's official guidance. Readers should verify information through each platform's official channels before taking any action and consult a qualified professional where appropriate. The MEXC Crypto Pulse team accepts no liability for any direct or indirect loss arising from the use of this information.

 

 

James Mitchell specializes in technical analysis, market trends, and trading strategies for both Bitcoin and altcoins. Based in London, he has over 10 years of experience in financial markets. Before joining MEXC Learn, James worked as a senior analyst at a leading European investment firm, where he developed expertise in risk management and quantitative trading. His transition to cryptocurrency markets began in 2017, and he has since become recognized for his data-driven approach. He holds a Master's degree in Financial Economics from the London School of Economics. His analytical approach combines traditional technical analysis with on-chain metrics to provide readers with actionable insights.

 

Areas of Expertise: Technical Analysis, Market Trends and Cycles, Trading Strategies, Bitcoin and Altcoin Analysis, Risk Management.

 

 

 

Want the fastest access to MEXC's latest updates? Join our official Telegram group now!

MEXC Platform: Download App | Zero Fee Trading | Buy USDT Now

Join MEXC Community: X (Twitter) | Telegram | Discord

Get Insights: MEXC Learn | Terms of Service | MEXC Blog | MEXC News

Account Verification: Understand KYC | How to Complete KYC

External Content Platforms: Substack | Medium | Paragraph | LinkedIn | X(News)