According to reporting by Decrypt, Coinbase has disclosed that a security incident at third-party analytics provider Amplitude compromised contact data belonging to a small subset of its customers. The exchange moved quickly to clarify that its own systems were not breached and customer funds remain fully secure.
The timing of the disclosure — coming via a Tuesday night tweet from Coinbase Support — underscores a growing vulnerability in cryptocurrency platforms: the risk posed by external vendors with access to sensitive customer information. Coinbase said it found no evidence of unauthorized access to its own infrastructure and is notifying affected customers and regulators as required by law.
The exchange did not disclose the number of customers affected, specific details about what contact data was exposed, when the incident occurred, or which other Amplitude clients were compromised. That opacity reflects a pattern common among both crypto and traditional finance firms when managing third-party breaches — minimal disclosure combined with compliance-first communication.
The Pattern of Vendor Vulnerability
Coinbase’s experience with Amplitude mirrors a broader industry problem. In September, hardware wallet manufacturer Trezor revealed that a breach at shipping provider ShipMonk had exposed names, phone numbers and home addresses for 67,000 U.S. customers. Some records dated back to 2019, despite ShipMonk’s claims years earlier that the data had been deleted.
The risk compounds over time. Stolen personal information — particularly home addresses paired with names — remains valuable to threat actors indefinitely. People change jobs and employers far more frequently than they relocate or switch phone numbers, making older data useful for years after exfiltration.
For Coinbase, this incident stands in sharp contrast to its internal security posture but highlights the impossibility of controlling all risk when relying on external vendors for core functions like analytics.
A Reminder of Recent Breaches
The Amplitude incident arrives roughly 17 months after Coinbase disclosed a far more serious breach affecting its own operations. In May 2025, the exchange revealed that cybercriminals had compromised overseas customer support agents through bribery, gaining access to personal data from less than 1% of its monthly active users.
A subsequent filing with the Maine attorney general put the toll at 69,461 customers whose names, addresses, masked Social Security numbers and government ID images were exposed. Coinbase refused a $20 million ransom demand and instead offered a $20 million bounty for information leading to the attackers’ arrest.
That breach underscored how human vulnerability — not technical failure — remains a critical vector for data theft in the digital asset industry. The Amplitude breach, by contrast, points to a different risk: the cascading exposure that occurs when platforms depend on vendors they cannot fully audit or control.
For crypto exchanges managing billions in customer assets, the lesson is clear: third-party access requires the same rigor as internal security, yet remains inherently harder to monitor and enforce.