Coinbase says user funds are safe after third-party vendor exposes customer contact info

Coinbase runs its own custody and trading infrastructure but, like most consumer apps, outsources functions such as product analytics to outside vendors; Amplitude is one of many firms in that category, not a Coinbase subsidiary. The exchange has been here before: a 2025 incident involving bribed overseas support contractors leaked account data and fed phishing campaigns against its users, forcing Coinbase to separate 'systems breach' from 'data exposure' in its public language ever since. This week's statement follows that same script.

Affected customers gain nothing new to do with their holdings, since trading and withdrawal functions were never touched, but they do face a fresh phishing risk now that names, emails or phone numbers tied to their accounts may be circulating outside Coinbase's own systems. The practical response is to verify any contact through bookmarked official channels rather than links in unexpected messages, not to change passwords or move funds. Other Amplitude clients beyond Coinbase were also hit, spreading exposure, and scrutiny, across the vendor's whole customer base rather than one exchange.

The episode reframes crypto security as a supply-chain problem rather than a private-key problem: an exchange can harden its custody architecture and still leak customer data through a marketing-analytics tool it barely controls. That cuts against the self-custody pitch crypto has long made to new users, since the weak point here was never a wallet or a seed phrase but ordinary SaaS plumbing shared with companies outside the industry entirely. Coinbase's insistence that funds are safe is accurate but narrower than the trust question the incident actually raises.

Coinbase's statement landed a day before its third-quarter earnings call, which will be the first forum where executives face direct questions on the incident's scale, remediation costs and any regulatory notifications already filed. Watch for whether the company discloses a customer count there, since outside estimates, including a claim of more than 70,000 affected users from blockchain security researcher SlowMist, remain unconfirmed against Coinbase's own 'small subset' description.

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.