Coinbase Amplitude Incident Exposed Contact Data: Steps Users Should Take Now

If you have a Coinbase account, your email address or phone number may now sit on a scammer's list, even though Coinbase says its own systems were never touched. Late on October 27, the exchange said Amplitude, an analytics company it works with, had a security incident that exposed "a small subset of Coinbase customer contact data, among other Amplitude customers," according to a Coinbase Support post on X quoted by PYMNTS and Decrypt.

The Coinbase Amplitude incident is not a hack of wallets or balances. Coinbase said it found "no evidence of unauthorized access to Coinbase systems" and that customer funds were not impacted. But contact details are exactly what phishing crews need, and Coinbase users have been a favorite target for years.

What Coinbase has confirmed so far

• The data came from Amplitude, a third party analytics vendor, not from Coinbase servers. "Coinbase has not had a data breach," the support account wrote, as quoted by Decrypt.
• The exposed information is described only as contact data. Cybersecurity News and FinanceFeeds report that it includes email addresses and phone numbers, but Coinbase has not confirmed the exact fields.
• Coinbase says it is notifying affected customers and regulatory agencies as the law requires. CoinDesk reports that the notices are going out by email.
• Other Amplitude clients were hit as well. None has been named publicly.

The open questions about Amplitude

Coinbase has not said how many users were affected. Cointelegraph asked and did not get a number. A figure of more than 70,000 users is circulating, attributed to a researcher at blockchain security firm SlowMist, but Coinbase has not confirmed it, so treat it as unverified.

Amplitude has not published a technical explanation either. Nobody outside the two companies has said how the attackers got in, when the incident started or who was behind it. Until that arrives, it is impossible to rule out that more data types were involved.

Why a leaked contact list is enough to cause trouble

An email address and a phone number, tied to the fact that you use Coinbase, let a scammer skip the guessing. They can text or call pretending to be Coinbase support, mention a suspicious login, and push you to "secure" your account. The goal is usually one of three things: your password and two factor code, remote access to your computer, or a transfer of crypto to a "safe" wallet they control.

This playbook keeps working. In the Ngrave hack, fake alerts did the damage, and the Electrum fee bump theft showed how a small trust gap can drain a wallet.

Seven steps for Coinbase users this week

1. Treat any unexpected call, text or email that claims to come from Coinbase as suspect, even if it uses your real name and number. Open the Coinbase app or type the web address yourself to check for real notices.
2. Remember what Coinbase staff will not do. Per the guidance repeated by Cybersecurity News, they never ask for passwords or verification codes, never ask for remote access to your device, and never tell you to send crypto to an outside address.
3. If you still get login codes by text message, switch to an authenticator app or a hardware security key. A leaked phone number makes SIM swap attempts easier.
4. Ask your mobile carrier to add a port out PIN or an account lock to your number.
5. Review your Coinbase security settings, including active sessions, linked devices and address allowlisting if you use it.
6. Watch for the official notice email and check its sender and links before clicking anything. Scammers often copy breach notices within days.
7. Keep long term holdings in a setup that cannot be unlocked by a convincing phone call, such as a hardware wallet with its recovery phrase stored offline.

A vendor problem the crypto industry keeps repeating

Third party tools are a weak point across finance. A PYMNTS Intelligence report found that 43% of phishing incidents had roots in third party breaches, and CoinGecko figures cited by PYMNTS put crypto platform losses from hacks and thefts above $3.6 billion over the prior 18 months.

Coinbase has spent the fall talking about long range risks such as quantum computing and bitcoin, while banks look at new custody models like Google's multi party compute. This week's problem is far older: an outside vendor holding customer data. Follow updates on the crypto page.

For now, the safest assumption is simple. If Coinbase really needs you, the message will be waiting inside the app.