Coinbase Denies a Breach It Just Confirmed as Vendor Leak Hits Over 70,000 Users

Coinbase is confirming a data leak and denying a breach in the same sentence. The exchange says customer contact information surfaced after a security incident at Amplitude, the third party analytics vendor it uses to track how people use its app and site, and it is drawing a hard line between a vendor's problem and its own.

A STATEMENT THAT DENIES AND CONFIRMS AT ONCE

The exchange's support account opened with a denial and then described exactly what had happened.

"Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted."

Coinbase said Amplitude experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers, and that it found no evidence of unauthorized access to Coinbase systems and customer funds were not impacted. The statement was issued on October 27, 2026.

WHERE THE 70,000 NUMBER CAME FROM

The clarification followed reports attributed to blockchain security firm SlowMist, which suggested that information associated with more than 70,000 Coinbase users had been compromised. Coinbase has not independently confirmed that figure or disclosed the exact number of affected customers. Coinbase hasn't said how many customers were affected, which data fields leaked, or when the incident started.

That gap is the whole story. A company can be technically accurate that its own servers were never touched while still leaving tens of thousands of people wondering if their email and phone number are now floating around for anyone to use.

A SECOND LEAK IN SEVENTEEN MONTHS

This is not Coinbase's first time writing this kind of statement. This incident echoes a May 2025 breach involving Taskus, a contractor hired for customer support, where bribed personnel improperly accessed sensitive information for 69,461 Coinbase users, exposing personal identification records, financial information, and limited transaction histories. Attackers in that case demanded $20 million, Coinbase refused, and the company absorbed remediation costs reaching hundreds of millions of dollars.

The pattern across both incidents is the same. The money stays untouched. The contact information does not, and that is exactly what a scammer needs to run a convincing phishing campaign against people who already trust the Coinbase name.

THE WIDER ATTACK WAVE AROUND IT

The Amplitude leak lands in the middle of a rough stretch for Bitcoin infrastructure. A Coldcard firmware flaw has drained more than $116 million in BTC since July 30, with Bitcoin.com News tracking losses topping that figure across multiple waves of thefts. Weeks later, an attacker who gained access to Keystone's website obtained the key its hardware wallets use to prove they are genuine, prompting the company to say it would destroy thousands of unsold devices carrying the compromised key. Keystone confirmed it would destroy 18,835 unsold devices after attackers obtained that authentication key.

Blockstream added its own warning the same week, telling users that emails claiming to be from info@blockstream.org are not legitimate and that recovery phrases are never requested by the company. None of these incidents are connected by a single actor, but they share a common thread: the weak point keeps being somewhere other than the core product.

WHAT TO ACTUALLY DO WITH THIS

Anyone who has ever used Coinbase should now expect a wave of emails and texts built around this leak, and the safest move is distrust by default. Do not click a link claiming to fix the problem Coinbase just disclosed. Verify any security email by going to Coinbase's site directly rather than through anything that lands in an inbox. Contact information cannot be unleaked, but a costly mistake in response to it can still be avoided.

This story comes from the Simply Bitcoin Live show. Watch the full episode.