Coinbase Says Its Systems Were Not Breached—but Exposed Contact Data Still Gives Scammers an Opening

Coinbase says its own systems were not breached after a security incident at analytics provider Amplitude exposed contact information belonging to a small subset of customers. That distinction matters.

It does not, however, make the exposed data harmless.

According to CryptoSlate, Coinbase found no evidence that anyone gained unauthorized access to its systems, and customer funds remained secure. The exchange said it was notifying affected customers and regulators, but it had not disclosed how many people were affected or precisely which contact fields were exposed.

Coinbase has not had a data breach.

Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.

We’ve found no evidence of unauthorized access to Coinbase systems, and…

— Coinbase Support (@CoinbaseSupport) October 28, 2026

The immediate takeaway is reassuring: this was not a report that Coinbase wallets were drained or that the exchange’s custody systems were compromised. The longer-term risk is more personal.

Names, email addresses, phone numbers and other contact details can give criminals the raw material for targeted phishing, SIM-swapping attempts and fake support contacts that look far more convincing than a generic spam message.

A vendor incident can still reach the customer

Crypto companies rely on outside vendors for analytics, communications, customer support and a long list of other services. Attackers do not always need to defeat an exchange’s strongest security controls if a supplier holds enough information to identify and approach its customers.

That is why the phrase “funds unaffected” should be read as the status of the incident, not as a guarantee that no one will try to exploit the exposed information later. A scammer who knows a target uses Coinbase can tailor a message around account verification, a withdrawal hold or a supposed security review.

The message can be false even when some of the personal details in it are real.

The warning landed during a broader burst of disclosures. Binance founder Changpeng Zhao pointed to incidents involving Coinbase’s vendor, Bithumb and two South Korean securities firms, arguing that leaked financial information can fuel both online attacks and physical risks.

4 data leaks reported today:

1. Coinbase’s vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.

In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin Securities

You can’t prevent a leak, but…

— CZ BNB (@cz_binance) October 28, 2026

South Korean authorities were investigating separate incidents at Bithumb, Daishin Securities and Mirae Asset. CryptoSlate reported that Daishin said records belonging to 38,490 customers were exposed, while Bithumb was investigating access to an internal employee communications system.

What Coinbase users should watch now

The safest response is not panic. It is skepticism.

Customers should treat unsolicited messages claiming to be from exchange support as hostile until independently verified through the exchange’s normal app or website. Recovery phrases and private keys should never be shared, and an urgent request to move funds is a major warning sign.

Hardware security keys or passkeys are stronger than SMS-based authentication against many account-takeover attempts. Withdrawal allowlists, session reviews and separate email aliases for financial accounts can also reduce the damage a targeted scammer can do.

Coinbase’s statement draws an important boundary around what happened: no evidence of access to Coinbase systems and no reported loss of customer funds. But the incident also shows why the security perimeter for a crypto account extends beyond the exchange itself.

When customer contact data leaks from a vendor, the next stage of the attack may arrive in the victim’s inbox or on the victim’s phone.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.