Coinbase Data Breach 2026: What the Amplitude Leak Exposed

Last checked: Oct 28, 2026. Based on Coinbase Support's statement on X and reporting from Unchained, CoinDesk, Decrypt, Cointelegraph, and TokenPost.

Coinbase says it was not hacked. Some customers' contact data leaked anyway.

On the evening of October 27, 2026 (US time; October 28 UTC), Coinbase Support posted on X:

"Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations."

The company did not name how many people were in that "small subset." It did not say when Amplitude's incident happened. It did not list the exact contact fields. And it did not name the other Amplitude customers who were also hit.

Here is what is known, what is not, and why leaked contact details still matter even when funds stay put.

#Was Coinbase hacked?

Coinbase says no. The support account's wording is direct: "Coinbase has not had a data breach." It also said there is "no evidence of unauthorized access to Coinbase systems."

What leaked came from Amplitude, an analytics company Coinbase uses. Customers deal with Coinbase. They do not sign up with Amplitude. The data still moved to a vendor, and a security incident at that vendor is what Coinbase says exposed it.

Decrypt, Cointelegraph, and TokenPost all reported the same core claim: Coinbase denies a breach of its own systems, and an Amplitude incident exposed some customer contact data.

If you searched "was Coinbase hacked," that is the distinction. The exchange says its systems were not broken into. A vendor copy of some customer data still leaked.

#What the Amplitude leak exposed

A Coinbase spokesperson told Unchained on October 28, 2026 that "contact and limited transaction data were impacted" but "not home addresses, or any other information that would allow someone to directly access your account or your funds."

Coinbase Support said the company is notifying impacted customers and regulators.

A viral post on X claimed hackers obtained contact details for more than 70,000 Coinbase users. The Coinbase spokesperson called that claim "false."

Do not treat any circulating headcount as confirmed. Coinbase has not published its own number.

#What Coinbase has not disclosed

Say this plainly, because search results will fill the gaps with guesses:

• How many customers were affected. Not disclosed.
• When the Amplitude incident happened. Not disclosed.
• Exactly which contact fields were in the vendor copy. Not disclosed. CoinDesk noted that Coinbase did not specify the contact-data fields involved.
• Which other Amplitude clients were hit. Not disclosed. Coinbase Support only said the incident impacted Coinbase data "among other Amplitude customers."

As of publication, Unchained reported that Amplitude had not posted a statement on its blog and had not immediately responded to a request for comment.

This article does not claim who the attacker was, how Amplitude was breached, or that the data was published or put up for sale. Those details are not in the sources above.

#This is not the May 2025 Coinbase incident

Coinbase has had a separate customer-data case before. Keep the two apart.

In May 2025, Coinbase disclosed that bribed overseas support staff passed customer data to criminals. A filing with Maine's attorney general said 69,461 users would be notified, according to Unchained and TokenPost.

Tuesday's Amplitude post did not tie the new incident to that earlier case. Coinbase did not link the two.

If a message, headline, or chatbot blends the viral headcount with the 2025 filing, treat that mix as unverified. The 2025 count is from a different incident. The new count has not been disclosed.

#Why leaked contact data still matters

Funds were not touched. That does not make the leak harmless.

CoinDesk noted that exposed emails and phone numbers "can still serve as valuable raw material for phishing and social-engineering attacks." Unchained wrote that leaked contact details such as email addresses and phone numbers are "a common starting point for phishing."

After a disclosure like this, expect messages that mention Coinbase, a "new sign-in," or an "account locked" warning and push you to act fast. The sender can look close to official because they already have a real email or phone number.

If you want a broader playbook for an exposed address, see Your Email Was in a Data Breach: What to Do Now. For how brokers turn a name and number into a script, see How Scammers Know Your Mom's Name.

#Your data can leak from companies you never signed up with

You did not open an Amplitude account. Your contact details can still sit there.

Apps share customer data with vendors you never picked: analytics, ads, support, shipping. A breach at any of them can expose you. The company you see in the app store is not the only company holding a copy.

That is the durable lesson, and it is not unique to crypto. The same pattern shows up in support contractors, payment processors, and marketing tools. You cannot audit every vendor. You can assume extra copies exist.

Practical steps:

1. Treat unexpected texts, emails, or calls about "a new sign-in" or "account locked" as phishing. Do not click links or call numbers in those messages. Open the app or type the site yourself.
2. Use a unique email and password per service. If one vendor copy leaks, reused logins are how one leak becomes several.
3. Prefer app-based two-factor authentication or passkeys instead of SMS where the service offers them. A leaked phone number makes SMS codes easier to target.
4. Check where your contact details are listed online and remove them. People-search sites and data brokers often republish emails and phone numbers from many sources. Fewer public listings means fewer easy targets for a phishing script.

These steps reduce risk. They do not guarantee that a vendor leak will never reach you, and they do not undo a copy that already left the vendor.

#What to do if you use Coinbase

1. Watch for a notice from Coinbase if you are in the affected subset. Coinbase said it is notifying impacted customers. Go to the official app or site yourself rather than following a link in a message.
2. Ignore unexpected Coinbase alerts that ask you to "verify," "unlock," or "confirm a new device." Type the address or open the app.
3. Keep a unique password on the account, and turn on app-based 2FA or a passkey if you have not already.
4. Scan for public listings of your email and phone. See where you're listed with a free scan.

UndoLeak erases your data from data brokers and keeps it off.

#Sources

All facts in this article come from the following sources:

• Coinbase Support on X (Oct 28, 2026)
• Coinbase Says Amplitude Incident Hit Contact and Some Transaction Data, Denies 70K Claim
• Coinbase says user funds are safe after vendor exposes customer data
• Coinbase Customer Data Hit in Analytics Vendor Breach, Funds Not Impacted
• Coinbase denies systems breach, says vendor exposed customer data
• Coinbase Says Amplitude Incident Exposed Some Customer Contact Data

---

Not affiliated with Coinbase or Amplitude.