Coinbase Customer Data Exposed in Analytics Vendor Security Incident

Coinbase recently disclosed a security incident involving Amplitude, a third-party analytics vendor, which resulted in the exposure of a small subset of Coinbase customer data, specifically contact information. The cryptocurrency exchange confirmed that its internal systems were not compromised and customer funds remained secure.

Coinbase is currently in the process of notifying the affected customers and relevant regulatory bodies, fulfilling its legal obligations. However, the company has not yet disclosed the exact number of individuals impacted, the specific types of contact data exposed, or the precise timeline of the incident. Details regarding other Amplitude customers affected by the breach were also not provided.

This recent event follows a more significant breach that Coinbase disclosed in May 2025. In that incident, cybercriminals reportedly bribed overseas customer support agents to gain access to personal data belonging to less than 1% of the exchange's monthly transacting users. Coinbase rejected a $20 million ransom demand and instead offered a $20 million bounty for information leading to the capture of the attackers.

A subsequent filing with the Maine attorney general revealed that 69,461 customers were affected. The exposed data included names, addresses, masked Social Security numbers, and images of government identification.

Incidents involving third-party vendors are a recurring challenge within the crypto industry. For example, in September, hardware wallet manufacturer Trezor disclosed a breach at its shipping provider, ShipMonk. This breach exposed the names, phone numbers, and home addresses of 67,000 U.S. customers. Choosing among the best crypto wallets is crucial for safeguarding digital assets against such vulnerabilities.

This was in addition to nearly 14,000 records previously disclosed in August, some of which dated back to 2019 despite ShipMonk having previously assured Trezor that the data had been deleted. Trezor advised affected customers to remain vigilant against fraudulent communications and potential physical security risks.