Coinbase Discloses Customer Data Exposure Following Breach at Third‑Party Analytics Vendor

Coinbase has disclosed that a security incident affecting a third-party service provider exposed contact information belonging to a small subset of its customers, while emphasizing that its own systems were not breached and customer funds remain secure.

The cryptocurrency exchange said the incident occurred at analytics vendor Amplitude, which processes certain customer data on Coinbase’s behalf. According to the company, there is no evidence that attackers gained unauthorized access to Coinbase infrastructure, wallets, trading systems, or customer assets. Impacted customers are being notified directly, and relevant regulators have been informed.

Coinbase issued the statement amid heightened concern across the cryptocurrency sector following a series of high-profile exchange attacks and thefts. The company moved quickly to reassure users that the exposure was limited to a third-party vendor and did not result from a compromise of Coinbase’s own environment.

While Coinbase has not publicly disclosed the exact number of affected customers, it stated that only a small subset of user information was impacted. The company has not indicated that passwords, account credentials, or financial information were exposed, and stressed that customer funds were not affected by the incident.

The disclosure comes during a period of increased scrutiny of security practices across the crypto industry. Recent attacks against digital asset platforms have resulted in substantial losses and operational disruptions, prompting exchanges to strengthen both internal controls and third-party risk management practices. Security experts continue to warn that vendors supporting cryptocurrency firms can represent an attractive attack pathway for threat actors seeking customer information or operational intelligence.

Coinbase said it continues to monitor the situation and is working with affected parties as part of its response. The company encouraged customers to remain alert for phishing emails, fraudulent communications, or other social engineering attempts that could make use of exposed contact details.