- Coinbase says contact information for some customers was exposed in an incident at Amplitude, an analytics firm it uses, and that its own systems show no sign of unauthorised access.
- It describes those affected as a “small subset” and has not published a figure or said which data fields were involved.
- Nothing in the account suggests funds or were touched. Contact details are still the raw material for phishing and fake support calls.
Coinbase says it wasn’t hacked. It also says some of its customers’ contact details are now sitting outside the company, taken from a business most of those customers have never heard of. Both of those statements can be true at the same time, and that’s the part worth understanding.
Nobody’s coins moved. But if your email address or phone number is now in someone else’s hands, along with the fact that you hold crypto at a named exchange, the next thing you get may be a very convincing message or call that appears to come from that exchange. That’s the actual risk here, and it arrives days or months later rather than today.
What Coinbase has said
The statement came from the Coinbase support account on X rather than a press release or a filing. According to it, the exposure happened at Amplitude, a product analytics provider Coinbase uses, and the incident also caught data belonging to Amplitude’s other clients. Coinbase says its own systems have not detected unauthorised access, that the exposed data is limited to contact information for a “small subset” of customers, that assets and keys are safe, and that it is emailing affected users because the law requires it.
All of that comes from Coinbase itself, relayed through CoinDesk, which says it has asked the company for further comment. There is no independent forensic review, regulator finding or third-party audit in the public record to sit alongside it yet.
Analytics vendors are everywhere in consumer apps and almost nobody outside the company thinks about them. They collect data on how people use a product, which screens they open, which flows they abandon, so the company can fix what isn’t working. To do that they need identifiers, and identifiers are usually enough to reach a person.
Why a supplier’s leak still lands on you
This is the gap between the company’s framing and your position. “Our core systems were not breached” is a statement about Coinbase’s infrastructure. It says nothing about where your details ended up, because they left through a door Coinbase chose to open for a supplier rather than a door someone forced.
The pattern is familiar across the industry: a wallet maker’s website, an exchange’s customer support contractor, a marketing platform. The attacker doesn’t go at the hardest target, they go at whoever that target shares data with. We have covered the same shape of incident before in our technology coverage, and the lesson each time is that the security of your account includes the security of every company your account’s data touches.
What exposed contact data buys an attacker is credibility. A caller who already knows your name, your email and that you hold money at a particular exchange does not need to guess. They need you to believe them for about ninety seconds.
What hasn’t been said
Coinbase has not published how many people were affected. “Small subset” is the company’s own characterisation of its own incident, and with no figure attached it can’t be checked. It has not said which fields were involved, whether that means email addresses alone, phone numbers, postal addresses or something more. It has not said whether UK accounts are among those caught, which matters if you are trying to work out whether to expect an email.
Also worth separating out: “funds are safe” and “customers are safe” are different claims. The first appears to hold. The second depends on what happens next with the data.
If you hold coins on Coinbase
A few things that cost nothing and close most of the gap. Coinbase will not ring you to ask you to move your money to a “safe” wallet, and no legitimate exchange does. If a message claims to be from them, don’t click the link in it, open the app or type the address yourself and check for the same notice there.
Beyond that, a withdrawal allow-list restricts outgoing transfers to addresses you have already approved, which blunts most account-takeover attempts. A passkey or a hardware security key is meaningfully stronger than SMS codes, because a text message can be intercepted by someone who has your phone number. If you want the longer version of the trade-offs between leaving coins on a platform and holding them yourself, our guide walks through both. The fee and feature detail on this particular platform sits in our Coinbase review.
What to watch
Whether Coinbase puts a number and a list of affected data fields on the record, in its help centre or in a regulatory filing, rather than leaving it at a social media post. As a Nasdaq-listed company it has disclosure obligations that a support account does not satisfy on its own.
And whether Amplitude’s other clients start publishing their own notices. If several do, the scale of this becomes clear from the outside regardless of what any one of them says about its own slice of it.