Coinbase says funds are safe after Amplitude vendor incident

Key points

• Coinbase says an Amplitude incident exposed contact info for a 'small subset' of customers
• Coinbase says its own systems were not accessed and customer funds are safe
• Coinbase is emailing affected customers and notifying regulators
• Number of affected users and exposed data fields were not disclosed

Coinbase said customer funds are safe after a security incident at Amplitude, a third-party analytics provider, exposed contact information belonging to a small subset of its customers. The exchange denied reports that it had been hacked, according to CoinDesk, which cited a post from the Coinbase Support account on X late Tuesday, October 27.

What Coinbase said happened

Coinbase said the incident originated at Amplitude rather than on its own infrastructure, and that it has detected no unauthorized access to its systems. According to CoinDesk’s account of the post, the exposed data covered contact information for a “small subset” of Coinbase customers, along with data related to other Amplitude clients.

Coinbase said it is emailing affected customers, as legal requirements call for. The Defiant reported that the exchange is notifying both affected users and regulators, and that customer funds were unaffected.

What remains unclear

Coinbase did not say how many customers were affected or which contact fields were exposed, CoinDesk reported. Passwords, private keys and funds were not reported as compromised. CoinDesk said it had asked Coinbase for comment.

Amplitude’s own description of the incident was not available in the reports reviewed, and neither outlet quoted a statement from the analytics firm. Some secondary outlets have circulated a figure of more than 70,000 affected users attributed to security firm SlowMist, but Coinbase has not confirmed any such number.

Phishing risk for exposed customers

CoinDesk noted that exposed email addresses and phone numbers can be used in phishing and social-engineering attempts, in which attackers impersonate a company to trick people into handing over credentials or sending funds. Customers who receive a notice from Coinbase, or an unexpected message claiming to be from the exchange, should treat links and requests for account details with caution and go to the official app or website directly.

Other exchange data incidents in the news

CoinDesk placed the Coinbase disclosure alongside several recent data-security incidents involving financial firms in South Korea. It reported that Daishin Securities had personal data on 38,490 customers, including names, email addresses and mobile numbers, compromised after unauthorized access was detected the previous week. It also cited Yonhap News Agency as reporting that exchange Bithumb had some customer personal information leaked in an attack by an outside party, and said financial authorities have begun inspecting a data breach at Mirae Asset Global Investments.

Those cases are separate from the Coinbase matter, and the reports do not link them to Amplitude.

Further details, including the number of affected customers and the data fields involved, would be expected to emerge as Coinbase completes its notifications to customers and regulators.