Coinbase says funds are safe, ties contact-data exposure to vendor Amplitude
In brief
- Coinbase denied reports of a hack and said customer funds are safe.
- Exposure originated at Amplitude, a third-party analytics provider, according to Coinbase.
- Coinbase said its own systems haven't seen any unauthorized access.
- Affected-customer count and exposed data fields weren't disclosed.
What Coinbase said
Coinbase Support's X account described the exposed data as only a "small subset" of contact information, alongside data related to other Amplitude clients. The exchange said its own systems haven't seen any unauthorized access. It's also informing impacted customers by email as required by law.
"small subset" (Coinbase Support, on X)
The Amplitude angle is Coinbase's account of what happened. CoinDesk's report didn't include a response from Amplitude, so the vendor's side of the story isn't on the record yet (and the origin of the exposure hasn't been independently confirmed).
What wasn't disclosed
Coinbase didn't specify how many customers were affected or exactly which contact-data fields were involved. CoinDesk said it reached out to Coinbase for comment on the matter.
That leaves the scope of the incident unclear.
For users, the message from the exchange is narrow but direct: funds are safe, Coinbase's own systems weren't accessed, and anyone impacted should be hearing about it by email.
Why third-party vendors matter
CoinDesk framed the disclosure as a supply-chain risk story. In that framing, customers can face security risks via third parties even when a company's core infrastructure is secure.
The outlet also noted that exposed email addresses and phone numbers can still serve as raw material for phishing and social-engineering attacks, even if passwords, private keys and funds weren't compromised. That's CoinDesk's analysis of the general risk. It isn't a reported consequence of this incident.
What's confirmed so far comes from Coinbase: a contact-data exposure it ties to a vendor, no unauthorized access to its own systems, and customer funds that it says are safe.
Frequently asked questions
Was Coinbase hacked?
Coinbase denied reports of a hack and said customer funds are safe. The exchange said its own systems haven't seen any unauthorized access and that the incident originated at Amplitude, a third-party analytics provider, according to its Coinbase Support account on X.
What customer data was exposed in the Coinbase Amplitude incident?
Coinbase said only a "small subset" of contact information was exposed, alongside data related to other Amplitude clients. The exchange didn't specify how many customers were affected or exactly which contact-data fields were involved.
Why does a contact-data leak matter if funds are safe?
CoinDesk noted that exposed email addresses and phone numbers can still be used for phishing and social-engineering attacks, even if passwords, private keys and funds weren't compromised. That's CoinDesk's analysis of the general risk, not a reported outcome of this incident.
