Crypto exchange Coinbase has denied reports of a new data breach that allegedly affects more than 70,000 customers. The exchange subsequently attributed the incident to a third-party analytics provider, distinguishing the exposure from unauthorized access to its internal systems.
The claim emerged amid discussions among security commentators regarding the possible exposure of customer contact information. The situation brings to mind Coinbase’s documented breach in 2025, when criminals accessed sensitive customer information by compromising its support personnel.
Who’s to Blame?
The controversy intensified after SlowMist Chief Information Security Officer 23pds reported that hackers had obtained contact information belonging to more than 70,000 Coinbase customers. The disclosure immediately raised questions about whether attackers could exploit the information to impersonate exchange representatives and deceive unsuspecting cryptocurrency holders.
However, Coinbase Support subsequently clarified that the exchange itself had not experienced a direct security breach. According to its explanation, the incident originated at Amplitude, a third-party data analytics provider whose security failure reportedly affected multiple clients, including Coinbase.
The exposure involved contact details belonging to a small subset of Coinbase users rather than evidence of unauthorized entry into Coinbase’s internal systems. Coinbase said its investigation uncovered no evidence that attackers accessed its internal infrastructure or compromised customer funds. The exchange said it was notifying affected customers and relevant regulatory authorities in accordance with applicable legal requirements.
Previous Coinbase Breach Highlights Wider Crypto Security Risks
The latest incident recalls Coinbase’s May 2025 security crisis, when criminals bribed overseas customer support personnel to obtain sensitive customer information. In its official disclosure, Coinbase said attackers targeted less than 1% of its monthly transacting users and subsequently demanded $20 million to conceal the stolen information.
The compromised records included names, addresses, telephone numbers, email addresses, certain identification documents, and limited account information.
Meanwhile, other crypto companies have faced similar exposure through external service providers, demonstrating how security risks extend beyond trading platforms themselves. In August 2026, hardware wallet manufacturer Trezor disclosed that a breach involving shipping provider ShipMonk exposed customer names, email addresses, telephone numbers, and shipping addresses.
Trezor subsequently reported that approximately 67,000 additional United States customers were affected after investigators identified older order records that had not been deleted. Meanwhile, Coldcard disclosed a separate July 2026 firmware vulnerability that weakened seed generation under specific conditions, although this was not a customer contact-information breach.
Jonathan Agozie | October 26, 2026
