On this page
Key takeaways
- Late on October 27, 2026 (US Eastern time), Coinbase's verified support account said a security incident at Amplitude, an outside analytics company, affected contact data for a small subset of Coinbase customers. Other Amplitude customers were affected too.
- Coinbase says it saw no sign that anyone got into its own systems, that customer funds were not affected, and that it is notifying impacted customers and regulators.
- Coinbase hasn't said how many people were affected. A figure of more than 70,000 users first appeared in an unsourced post by an X account called DelCrxpto and was repeated by SlowMist's chief information security officer, 23pds. Coinbase has not confirmed it.
- The real risk is what comes next: calls, texts and emails from people pretending to be Coinbase. Coinbase says it will never ask for your password or 2FA codes, or tell you to move your crypto to a new wallet.
Coinbase, the Nasdaq-listed crypto exchange, says some of its customers' contact details were exposed, not by a hack of Coinbase itself but through a security incident at one of its outside vendors. Customer funds were not affected, according to the company. But a list of people who use a crypto exchange, with ways to reach them, is exactly what impersonation scammers want.
What happened
Late on Tuesday, October 27, 2026 (US Eastern time), Coinbase's verified support account on X posted a short statement. It opened: "Coinbase has not had a data breach." According to the statement:
- Where it happened: Amplitude, an analytics vendor, had a security incident.
- What was affected: "a small subset of Coinbase customer contact data," along with data belonging to other Amplitude customers.
- What wasn't: Coinbase says it "found no evidence of unauthorized access" to its systems, and that customer funds were not impacted.
- What's next: Coinbase says it is telling the affected customers and the relevant regulators, as the law requires.
Claims of a breach had been circulating on X for hours before that. Unchained traced the 70,000 figure to an X account called DelCrxpto, which claimed around 8 p.m. ET, with no source named, that a breach at Coinbase had been verified and that over 70,000 users' contact details had been taken. About two hours later 23pds, the chief information security officer of blockchain security firm SlowMist, repeated the claim while quoting that post. Unchained said it found no report from SlowMist itself. Coinbase hasn't confirmed that number. Cointelegraph said it asked Coinbase how many customers were affected and hadn't heard back when it published. CoinDesk and Wu Blockchain also reported Coinbase's account.
What we don't know yet
- How many customers are affected. Coinbase hasn't given a count.
- Exactly which details leaked. Coinbase said "contact data" without listing the fields. Contact data usually means things like email addresses and phone numbers, but Coinbase hasn't spelled it out.
- How Amplitude was breached, and when. We found no public statement from Amplitude when we published.
Why contact details are valuable to scammers
Amplitude sells product analytics, software that shows companies how people use their apps and websites. Coinbase's own cookie policy lists Amplitude among the services it uses for website visitor tracking. That's ordinary for a big website, and it shows how customer data can end up with companies you've never dealt with directly.
A leaked email address or phone number can't move your crypto by itself. What it gives a criminal is a list of people who are known to use a crypto exchange and a way to contact them. The classic play is a fake "Coinbase support" call or text: your account is "under attack," and you must move your funds to a "safe" wallet right now. That's social engineering, and it works because the victim does the transfer.
Coinbase has seen this before. In May 2025 it disclosed a separate incident: criminals paid off a group of its overseas support staff, who copied data on fewer than 1 in 100 of the customers who trade with Coinbase in a typical month, with the aim of contacting those customers while pretending to be Coinbase. The new incident is different: Coinbase says it happened at a vendor, and Coinbase describes the affected data as contact data.
What this means for you
- Hang up on "Coinbase" callers. Coinbase's help center says nobody from Coinbase will ask for your password or 2FA codes, or tell you to send your assets to a new or specific wallet, vault, account or address.
- Never move crypto to a "safe wallet" someone gives you. Coinbase says it won't ever phone or text you with a new seed phrase or a wallet address for your funds.
- Reach Coinbase only through its official app or website. Its help center says to use the phone number or email on its Contact us page, not a number from a message.
- Lock first, ask later. If something feels wrong, Coinbase suggests locking your account in the app and emailing security@coinbase.com.
- Use strong two-factor sign-in. Coinbase recommends strong 2FA, with hardware security keys best, plus withdrawal allow-listing, which limits transfers to addresses you've approved.
- A breach notice can itself be fake. Don't click links in an "incident" email. Open the app yourself and check there.
Not sure about a message? Paste it into our free Scam Check, and read our guide to impersonation scams.
The takeaway
Coinbase says its own systems weren't breached and no funds were affected; the leak was a small subset of customer contact data held by its analytics vendor Amplitude. The count is unconfirmed. Whether or not you get a notice, treat any unexpected call, text or email claiming to be Coinbase as a scam until you've checked it in the official app. This is education, not financial advice, and it reflects Coinbase's statement and news reports as of October 28, 2026.
Frequently asked questions
Was my Coinbase account hacked?
Coinbase says no: it has seen no sign that its own systems were accessed without permission, and customer funds were not affected. What leaked, according to Coinbase, was a small subset of customer contact data held by its analytics vendor. Coinbase says it is notifying the customers involved.
What is Amplitude?
Amplitude is a company that sells product analytics, software that helps apps and websites see how people use them. Coinbase's cookie policy lists Amplitude among the outside services used on its website.
Were 70,000 people affected?
That number hasn't been confirmed. It was first posted, without a source, by an X account called DelCrxpto, then repeated by 23pds, the chief information security officer of the blockchain security firm SlowMist. Unchained said it found no report from SlowMist itself. Coinbase described the affected group only as a small subset of customers, and Cointelegraph said Coinbase hadn't answered its question about the count.
Someone called saying they're from Coinbase and my account is at risk. What should I do?
Hang up. This is general education, not personal advice. Coinbase's help center says it won't ever phone or text you with a fresh seed phrase or a wallet address for your funds, and that you should only contact it through the details on its official Contact us page.
Sources
- Coinbase Support on X: statement on the Amplitude incident (October 28, 2026 UTC) (opens in a new tab) — Coinbase Support on X
- Technical support and impersonation scams (opens in a new tab) — Coinbase Help Center
- Coinbase says user funds are safe after third-party vendor exposes customer contact info (opens in a new tab) — CoinDesk
- Coinbase denies systems breach, says vendor exposed customer data (opens in a new tab) — Cointelegraph
- Coinbase Ties Customer Contact Data Exposure to Vendor Amplitude, Says It Was Not Breached (opens in a new tab) — Unchained (via Yahoo News)
- Wu Blockchain on X: SlowMist CISO report and Coinbase response (October 28, 2026) (opens in a new tab) — Wu Blockchain on X
- Cookie Policy Third-Parties (opens in a new tab) — Coinbase
- Protecting Our Customers - Standing Up to Extortionists (May 2025) (opens in a new tab) — Coinbase
Published October 28, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.