Coinbase says vendor Amplitude breach exposed customer contact data, not funds
Regulation & Gov ·
Coinbase disputes characterizations of a "data breach," saying a security incident at third-party analytics vendor Amplitude exposed contact information for a limited group of its users.
Coinbase stated that Amplitude, which it uses for analytics, experienced a security incident affecting a small subset of Coinbase customer contact data, alongside data belonging to other Amplitude clients, according to a statement posted on X. The company said it has found no evidence of unauthorized access to its own systems and that customer funds were not affected by the incident.
Reporting on the cluster puts a figure on the scope of the exposure: more than 70,000 Coinbase users had contact information leaked as a result of the Amplitude compromise, per coverage tracked by wublockchain.xyz. That figure has not been confirmed directly by Coinbase in its own public statement, which described the impact only as a "small subset" of customer contact data.
The distinction Coinbase is drawing matters because it separates a breach of its own infrastructure from a breach of a vendor it relies on for analytics. Amplitude serves many customers beyond Coinbase, and the incident is described as affecting Amplitude's systems rather than Coinbase's internal environment. Because the exposed data is limited to contact details rather than account credentials or funds, Coinbase has framed the event as a vendor-side failure with no evidence of broader compromise.
Coinbase said it is notifying affected customers and regulatory agencies as required under its legal obligations, language that points to mandatory breach-disclosure processes rather than a voluntary announcement. Multiple outlets covering the episode converge on the same core facts: an Amplitude security incident, contact-data exposure limited to a subset of users, and no indication that Coinbase's own systems or customer funds were touched.
What remains unclear is the precise number of affected Coinbase users, the exact nature of the contact data exposed, and the timeline of Amplitude's incident and Coinbase's discovery of it. Also unresolved is whether regulators will take any action in response to the notifications, and whether additional vendors or customer segments will be identified as the investigation into Amplitude's breach continues.