Coinbase (NASDAQ: COIN) has recently rejected claims of a direct systems compromise, attributing the exposure of certain customer contact details to a security incident at its analytics provider Amplitude.
In statements issued through its official support channel on X, the company emphasized that its own infrastructure remained secure and that customer funds were unaffected.
The clarification followed circulating reports of unauthorized access to user information. But these reports or claims are actually not credible and Coinbase continues to operate normally at the time of writing.
Coinbase stated that Amplitude, a third-party analytics vendor, encountered a security event that may have affected contact data belonging to a limited portion of Coinbase customers, as well as data tied to other Amplitude clients.
The exchange reported finding no indication of unauthorized entry into its own systems.
It confirmed that funds held by customers were not impacted and said it is contacting affected individuals while also informing relevant regulatory authorities in line with applicable legal requirements.
Amplitude provides digital analytics tools that help companies track and understand user behavior within applications and websites.
Organizations commonly integrate such services to analyze engagement, feature usage, and customer journeys.
In this case, the vendor’s incident may have led to the exposure of contact information linked to a small subset of Coinbase users. However, this appears to have been contained and not an issue where Coinbase systems were impacted.
The company has not disclosed the precise number of affected accounts, the specific fields of data involved, or the exact timing of the Amplitude event.
Independent observers noted claims circulating online that contact details for certain Coinbase users may have been accessed.
Those figures originated from posts attributed to 23pds, chief information security officer at the blockchain security firm SlowMist.
Coinbase has not verified that number and continues to describe the scope only as a small subset of its customer base. The exchange has not confirmed whether passwords, transaction records, or other sensitive account details beyond contact information were involved.
The distinction between a vendor-side incident and a breach of Coinbase’s core systems is central to the company’s response.
While Coinbase maintains that its platforms were not accessed without authorization, the exposure of emails, phone numbers, or similar contact data can still create risks for targeted phishing or social-engineering attempts.
Attackers often use such information to pose as legitimate support representatives and pressure users into revealing credentials or transferring assets.
Coinbase has stressed that customer funds remain secure and that it is fulfilling notification obligations.
This development arrives roughly 17 months after Coinbase disclosed a separate incident in May 2025.
In that earlier case, the company reported that a limited group of overseas support agents had been induced to misuse access to customer support tools, affecting less than 1 percent of monthly transacting users.
Remediation and potential reimbursement costs were estimated in the hundreds of millions of dollars.
No passwords, private keys, or funds were exposed in that episode either, according to Coinbase at the time.
The current situation underscores the broader challenges of third-party risk in financial technology.
Even when an organization’s primary systems stay intact, data shared with analytics, marketing, or operational vendors can become a point of exposure.
Coinbase has not issued further public details on the Amplitude incident beyond its support statements and has not responded to requests for the exact scale of the affected customer set.
Users who receive notifications from Coinbase are advised to review official communications carefully and remain alert to unsolicited contact claiming to address security concerns. The exchange continues to affirm that its systems show no signs of unauthorized access and that customer assets were not compromised.
Note: Crowdfund Insider received some clarification on this incident. It can be confirmed at the time of writing that no user accounts were compromised or funds accessed.
