Overview
- Coinbase said an analytics vendor, Amplitude, experienced a security incident that exposed a small subset of customer contact information and that its own systems were not accessed.
- The exchange said customer funds and sensitive credentials such as passwords or private keys were not exposed and that it has found no evidence of unauthorized access to Coinbase systems.
- Independent researcher SlowMist’s 23pds circulated an unverified claim that more than 70,000 Coinbase contacts were obtained, and Coinbase has not confirmed how many customers were affected.
- Coinbase is emailing users whose contact details were involved and has contacted regulators in line with legal obligations, and it warned customers to be alert for phishing or social‑engineering attempts using the leaked emails and phone numbers.
- The case highlights supply‑chain risk from third‑party analytics vendors and follows a run of recent data incidents in the financial and crypto sectors, raising questions about how firms limit vendor access to customer information.