Coinbase has responded to reports of a data breach by saying that its own systems were not compromised. The company said a security incident at third-party analytics provider Amplitude exposed a small subset of Coinbase customer contact information, but that no customer funds were affected.
What Coinbase said
In a statement posted by Coinbase Support on X, the company said, “Coinbase has not had a data breach.” It explained that Amplitude, an analytics vendor, experienced a security incident that affected a 'small subset' of Coinbase customer contact data, along with data belonging to other Amplitude customers.
Coinbase said it found no evidence of unauthorised access to its own systems. It also stressed that customer funds were not impacted, seeking to distinguish the vendor incident from a breach of the exchange’s core infrastructure.
What information was exposed
The company said the affected data was limited to customer contact information, but it did not specify whether that included email addresses, phone numbers, names, or other details. Coinbase also did not disclose how many customers were affected, when the incident occurred, or how long the data may have been exposed.
Amplitude provides product-analytics services that help companies understand user behaviour across apps and websites. Because such vendors may receive customer data, an incident at the provider can expose information even when the client company’s own systems remain secure.
Coinbase is notifying users
Coinbase said it is contacting affected customers by email and notifying regulatory agencies in line with its legal obligations. The exchange has not shared the exact wording of those notifications or provided further technical details about the incident.
Unconfirmed reports circulating online claimed that contact information for more than 70,000 users may have been accessed. Coinbase has not verified that figure, and neither Coinbase nor Amplitude has publicly confirmed it.
Why users should stay alert
Although no funds were reported lost, exposed contact details can still be valuable to scammers. Criminals may use email addresses or phone numbers to send convincing phishing messages, fake security alerts, or impersonation attempts claiming to be from Coinbase support.
Customers should avoid clicking unexpected links, never share passwords, one-time codes, or recovery phrases, and verify any security communication directly through Coinbase’s official app or website. Coinbase has not said whether passwords, two-factor authentication details, or private keys were involved; its statement indicated the exposure involved contact data.
