- Coinbase said a security incident at analytics vendor Amplitude exposed contact data for a “small subset” of its customers.
- Coinbase found no evidence of unauthorized access to its systems and said customer funds were not impacted.
- SlowMist’s 23pds claimed hackers got contact details for more than 70,000 users, a figure Coinbase has not confirmed.
Coinbase said a security incident at analytics vendor Amplitude compromised contact data for a “small subset” of its customers.
In a late Tuesday statement, it denied any breach of Coinbase’s own systems and said other Amplitude clients had also been affected.
SlowMist’s 23pds claims more than 70,000 were hit
“Coinbase has not had a data breach,” the exchange’s support account wrote on X. The post depicted it as a security incident at Amplitude, an analytics vendor, that “impacted a small subset of Coinbase customer contact data, among other Amplitude customers.”
Coinbase said it found no signs of any unauthorized access to its systems. The exchange said customer funds were not touched.
The company is notifying impacted customers and regulatory bodies as required by law. There’s no disclosed number of users affected, no list of exposed fields, and no date for the Amplitude incident.
About 30 minutes before Coinbase posted, 23pds, chief information security officer at blockchain security firm SlowMist, wrote on X that the breach was confirmed and that hackers had obtained contact information for more than 70,000 users.
It was not immediately confirmed if passwords or funds were stolen, the same post said. Coinbase has not confirmed the 70,000 figure, saying in its own statement that it was a “small subset” of customers.
Leaked customer lists give scammers a ready phishing target
Exposure of contact details leaves passwords, keys and funds untouched. But they are fodder for phishing and social engineering.
The same problem occurred with hardware wallet maker SafePal in August 2026, when an access control vulnerability exposed order data for around 39,798 customers. Scammers can use the stolen details to make fake support calls, offer bogus refunds, send sham software update requests and send links to cloned phishing sites, SafePal warned, reported Cryptopolitan.
Coinbase customers have had a similar experience. In May 2025, the exchange disclosed a breach in which criminals bribed overseas support agents to hand over personal data for a subset of users.
Coinbase said the criminals planned to use that list of customers to pretend to be the exchange and get people to send crypto. It set aside between $180 million and $400 million to fix the problem and pay back customers. It also offered a $20 million reward for information leading to arrests.
On-chain investigator ZachXBT reckoned the toll to be $300 million per year, with Coinbase users losing more than $65 million to such scams in two months, the investigator said in February 2025.
In March 2026, the same SlowMist executive, 23pds, said that an official Coinbase Commerce page that asked users to type in their recovery phrases was bad.
23pds said it was “extremely foolish” to ask users to send a mnemonic phrase to check assets.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
Did Coinbase itself get hacked?
No. Coinbase said it found no evidence of unauthorized access to its systems and blamed a security incident at analytics vendor Amplitude.
What kind of Coinbase data was exposed?
Customer contact data for a small subset of users, Coinbase said. It has not named the exact fields.
Why does a contact data leak matter?
Leaked contact details help scammers fake support calls and cloned websites, as SafePal warned after its August 2026 leak of about 39,798 customers' order records.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
