Cryptocurrency exchange Coinbase has confirmed that a security incident at third-party analytics vendor Amplitude resulted in the exposure of contact information belonging to a subset of its users.
According to statements released by Coinbase Support on the social media platform X on Wednesday, the incident affected a "small subset" of Coinbase customers alongside clients of other organizations that utilize Amplitude’s data analytics services. The exchange was quick to clarify that its own internal infrastructure and core systems experienced no security breaches or unauthorized access. Furthermore, Coinbase emphasized that customer funds, account balances, and digital assets remain completely secure and unaffected by the third-party data exposure.
The disclosure arrives amid a broader wave of cybersecurity concerns affecting both the digital asset industry and traditional financial institutions worldwide. On the same day as the Coinbase announcement, South Korean crypto exchange Bithumb revealed that it was actively investigating an internal system breach to determine whether a compromise of its internal work platform had led to the exposure of sensitive customer data. Simultaneously, traditional South Korean brokerage Daishin Securities reported a separate security leak that compromised the personal and credit details of 38,490 customers.
While Coinbase has moved to reassure users that the fallout from the Amplitude incident is limited to contact details, representatives from Cointelegraph reached out to the exchange to obtain a precise figure regarding the exact number of individuals affected. At the time of publication, a response had not yet been provided by the company.
The latest incident underscores the complex web of interconnected third-party services that modern financial platforms rely upon, as well as the inherent vulnerabilities introduced by relying on external data processors and analytics providers. For Coinbase, third-party data dependencies have previously proved costly. In May 2025, the exchange disclosed a separate, highly publicized data breach that directly impacted fewer than 1% of its monthly transacting users. At the time, the security lapse prompted extensive remediation efforts, with the exchange estimating that total reimbursement, notification, and operational recovery costs could reach up to $400 million.
The recurring nature of cybersecurity challenges across the digital asset sector highlights the ongoing struggle major exchanges face in securing not only their proprietary networks but also the expansive ecosystems of vendors and partners they interact with daily. As financial institutions increasingly adopt cloud-based analytics, customer relationship management tools, and behavioral tracking systems, supply chain vulnerabilities continue to serve as an inviting vector for malicious actors seeking to harvest user data.
Industry analysts note that while contact information leaks typically do not grant attackers direct access to customer funds or private cryptographic keys, exposed phone numbers, email addresses, and physical locations can significantly elevate the risk of targeted phishing attacks, SIM-swapping campaigns, and social engineering schemes directed at account holders. Consequently, security experts consistently advise cryptocurrency investors and exchange users to remain vigilant, enable multi-factor authentication methods that rely on hardware security keys rather than SMS codes, and exercise extreme caution when receiving unsolicited communications that appear to originate from support services.
As investigations into the Amplitude incident continue, affected users are expected to receive direct notifications from Coinbase detailing the specific scope of the exposure related to their accounts. Both Coinbase and external cybersecurity researchers continue to monitor the situation to ensure that the fallout from the vendor breach remains contained and that no secondary data exploitation attempts target the exposed user base.
Comments (0)