Short answer
On 27 October 2026 Coinbase said a security incident at its analytics provider Amplitude affected a small subset of its customers' contact data. Coinbase says it was not breached, found no unauthorized access to its systems, and that customer funds were not impacted.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Coinbase (via vendor Amplitude) |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Cryptocurrency exchange |
| Country | United States |
| Disclosed | 2026-10-27 |
| People or records affected | A small subset of Coinbase customers. Coinbase has not given a number and calls a circulating 70,000 figure false |
What data was exposed
- Customer contact data
- Limited transaction data, according to a Coinbase spokesperson
What happened
On the evening of 27 October 2026, Coinbase’s support account posted that “Coinbase has not had a data breach.” It said a security incident at Amplitude, a third-party analytics provider, had “impacted a small subset of Coinbase customer contact data, among other Amplitude customers.” Unchained and Bitcoin.com News reported it on 28 October.
Coinbase said it found no evidence of unauthorized access to its own systems and that customer funds were not impacted. It said it is notifying affected customers and regulators in line with its legal obligations.
What data was involved
Coinbase has not listed the fields. A spokesperson told Unchained that “contact and limited transaction data were impacted” but not home addresses or any other information that would allow someone to directly access an account or funds. Bitcoin.com News said unnamed secondary accounts pointed to email addresses and phone numbers, which Coinbase has not verified.
What is still unknown
Coinbase did not say how many customers were affected, when the Amplitude incident happened, or which other Amplitude customers were hit. Neither outlet quoted Amplitude, and Unchained said the vendor did not respond to a request for comment. How the attackers got into Amplitude has not been reported.
The 70,000 claim
Social media accounts, including one run by a security executive, circulated a claim that more than 70,000 users were affected. Both outlets say it is unverified. The Coinbase spokesperson called it false and suggested it came from confusion with a May 2025 case in which 69,461 users were notified of an insider-related breach. We treat the figure as an unconfirmed rumor.
What this means for you
Contact data is enough to power convincing scams. The usual pattern is a call or text from a fake “Coinbase security” agent who says your account is under attack and tells you to move funds or read out a code. Coinbase will not ask for your recovery phrase or a 2FA code.
See our data breach checklist, the guide to SIM swap and account takeover scams and the one on crypto wallet drainer and fake airdrop scams.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Texts, calls and emails claiming to be Coinbase support that cite your contact details to seem real.
- Fake 'account locked' or 'suspicious withdrawal' alerts that push you to a phishing page or to move funds to a 'safe wallet'.
- Callers who ask for 2FA codes, seed phrases or remote access to your device.
What to do if you are affected
- 01Treat any unsolicited message or call about your Coinbase account as suspect, and log in by typing the address or opening the app yourself.
- 02Never share a recovery phrase, 2FA code or password with anyone, including people who say they are Coinbase staff.
- 03Use an authenticator app or passkey rather than SMS for two-factor authentication, to reduce SIM swap risk.
- 04Review your account's security settings and recent activity for changes you did not make.
- 05If you receive a notice from Coinbase, check it through the app before acting on any link in it.
Frequently asked questions
Was Coinbase itself hacked?
Coinbase says no. Its support account said it has not had a data breach, found no evidence of unauthorized access to its systems, and that the incident was at Amplitude.
Are my funds at risk?
Coinbase says customer funds were not impacted and that the data did not include home addresses or anything that would let someone directly access an account or funds. The main risk is phishing.
Were 70,000 users affected?
That figure was posted by social media accounts without a source. A Coinbase spokesperson told Unchained it was false and may have come from confusion with the May 2025 incident. Coinbase has not published its own count.
What has Amplitude said?
At the time of the two reports, neither outlet quoted a statement from Amplitude, and Unchained said Amplitude did not respond to a request for comment.
Sources
- Coinbase ties customer contact data exposure to vendor Amplitude, says it was not breached, Unchained, 2026-10-28
- Coinbase denies platform intrusion as vendor data leak emerges, Bitcoin.com News, 2026-10-28
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.