Coinbase Data Breach Amplitude: Vendor Leak and Bithumb Fallout

The Coinbase data breach Amplitude episode, as it is being called across crypto media, began not inside a crypto exchange at all, but at a company most users have never heard of. On October 28, 2026, Coinbase, the largest cryptocurrency exchange in the United States, said a security incident at Amplitude, a third-party analytics vendor, had exposed contact information belonging to a small subset of its customers. The exchange insisted, in unusually blunt language, that it had not itself been breached, that no unauthorized access to its own systems had been found, and that customer funds were untouched. Within hours, the story had grown into a wider one, with South Korean exchange Bithumb reporting its own leak and two South Korean financial firms disclosing breaches of their own.

The episode matters far beyond its immediate facts because it exposes a structural weakness in how the crypto industry handles personal data. Exchanges spend enormous sums securing wallets, private keys, and trading engines. Yet customer information routinely flows to dozens of outside vendors: analytics tools, customer-support contractors, email providers, and marketing platforms. Each vendor is a potential doorway, and attackers have learned to try the side doors when the front door is locked. The Coinbase incident is the latest reminder that a user’s safety can depend on the weakest link in a chain they never chose to join.

Coinbase Data Breach Amplitude: What Happened at the Vendor

Coinbase’s statement arrived on X early on Wednesday, October 28, 2026, from the company’s support account. Its first line was a denial framed as a correction: “Coinbase has not had a data breach.” The post went on to say that Amplitude, an analytics vendor, had experienced a security incident that affected a small subset of Coinbase customer contact data, along with data belonging to other Amplitude customers. Coinbase added that it had found no evidence of unauthorized access to Coinbase systems and that customer funds were not affected.

Amplitude makes software that companies use to understand how people interact with their apps and websites: which buttons they click, which features they use, and how they move through a product. To do that work, analytics tools typically receive identifiers such as email addresses or phone numbers, which let a company connect behavior across sessions. That is precisely why an incident at such a vendor is serious even when no money moves. Contact details are the raw material of phishing, the fraudulent messages and phone calls designed to trick people into handing over passwords, approval codes, or access to their accounts.

A statement emailed later to Unchained by a Coinbase spokesperson added an important detail: both contact data and limited transaction data were affected, but not home addresses, and nothing that would allow someone to directly access an account or funds. Coinbase said it is notifying affected customers directly, as well as regulators, as required by law. What Coinbase has not done is put a number on the incident. It has repeatedly described the affected group only as a “small subset” of customers, without saying how many people that means, when the Amplitude incident occurred, or who was behind it.

That gap has been filled, imperfectly, by outside claims. An account on X posted that hackers had obtained contact details for more than 70,000 Coinbase users, and the claim was then repeated by 23pds, an account describing its owner as a partner and chief information security officer at blockchain security firm SlowMist. Coinbase has called the 70,000 figure false. Unchained reported that it found no report from SlowMist itself supporting the number. The honest position, for now, is that the true scale is unconfirmed: a widely circulated estimate exists, the company disputes it, and neither side has published evidence that settles the question.

Bithumb Data Leak and the South Korean Incidents

The Bithumb data leak unfolded in parallel and added a second major exchange to the week’s security news. Bithumb, one of South Korea’s largest crypto exchanges, reportedly detected abnormal access to an internal employee system on October 27, with customer data reportedly leaked the following day. Bithumb was still assessing whether customer data had been exposed and to what extent, and its investigation was continuing as the Coinbase story broke. The exchange’s leak appeared to involve an internal tool rather than a third-party vendor, which makes it a different kind of failure: not a side door left open by a supplier, but a problem inside the house.

Two other South Korean firms disclosed breaches in the same wave. Daishin Securities, a brokerage, reported that data belonging to 38,490 customers had been exposed, a precise figure that contrasts sharply with the uncertainty around Coinbase’s numbers. Mirae Asset, another major South Korean financial firm, also reported a security breach, though details of its scope were still emerging. The clustering of four disclosures in a single week, across two countries and both crypto and traditional finance, suggests less a coordinated attack than a shared vulnerability: financial firms of every kind now hold vast amounts of customer data across sprawling networks of internal tools and outside vendors, and attackers are probing all of it.

What Leaked, What Did Not, and Why the Distinction Matters

Sorting out exactly what leaked and what did not is essential, because the difference determines the real risk to users. According to Coinbase, what leaked was contact data for a small subset of customers, plus limited transaction data. What did not leak, according to the company, includes passwords, private keys, home addresses, and anything that would let someone directly access an account or move funds. No unauthorized access to Coinbase’s own systems was found, and customer funds were not affected. If that account holds, the incident is a privacy and phishing exposure, not a theft.

That distinction is real, but it should not be overstated. Contact details are not harmless. The history of crypto crime is full of cases where leaked emails and phone numbers became the first step in a longer attack. After Coinbase’s May 2025 incident, in which criminals bribed support staff at an outside contractor to steal customer data, victims were targeted with convincing impersonation calls and messages, and some were tricked out of their money. About 69,000 customers were affected in that incident, and Coinbase estimated the cost of reimbursements and cleanup at up to $400 million. The 2025 case involved deeper personal data, including names and addresses in some reports, and it drew a Department of Justice investigation. The Amplitude incident appears narrower in scope, but the playbook it enables is the same: contact a user, sound like Coinbase support, create urgency, and harvest credentials or approvals.

Why Vendor Risk Keeps Producing Crypto Exchange Data Leaks

The recurring pattern behind this crypto exchange data leak deserves explanation, because it keeps repeating with different company names attached. Modern exchanges are not single fortresses; they are networks of software services. A typical exchange relies on outside firms for analytics, customer support, fraud detection, email delivery, cloud hosting, and identity verification. Each relationship involves some transfer of customer data, and each transfer is governed by contracts and security reviews that vary enormously in rigor.

Analytics vendors sit in a particularly sensitive spot. Their entire business is observing user behavior, which means they receive a continuous stream of identifiers and activity records.

User Protection: What Customers Should Do Now

For users, the practical advice after a crypto exchange data leak is consistent and worth repeating in full, because the attacks that follow a leak are designed to exploit exactly the confusion the leak creates. First, expect phishing. Treat any unexpected call, text, or email claiming to be from Coinbase, Bithumb, or another exchange as suspicious, even if it uses your real name or references a real account detail. Legitimate support teams will not ask for your password, your two-factor authentication codes, or your seed phrase, and they will not pressure you to move funds to a “safe” wallet. Any message that does those things is fraudulent, however convincing it sounds.

Second, verify through official channels. If a message claims there is a problem with your account, do not click its links or call its numbers. Open the exchange’s app or type its website address yourself, and check for notices there. Enable app-based two-factor authentication if you have not already, since it is far harder to phish than text-message codes, and consider a hardware security key for accounts holding significant funds. Review recent account activity and connected devices, and change your password if anything looks unfamiliar.

Third, be careful with your contact details themselves. If your email address or phone number was exposed, you may see a rise in spam, impersonation attempts, and SIM-swap probes, in which an attacker tries to convince a mobile carrier to transfer your number to their device. Contacting your carrier to add a port-out PIN or similar protection is a sensible precaution, and using a separate email address for financial accounts reduces the blast radius of any single leak.

Frequently Asked Questions

Q: Was Coinbase itself hacked?

A: Coinbase says no. It says the incident happened at analytics vendor Amplitude, that it found no evidence of unauthorized access to its own systems, and that customer funds were not affected.

Q: What data was exposed in the Coinbase incident?

A: Contact data for a small subset of customers, plus limited transaction data. Coinbase says home addresses, passwords, private keys, and account-access details were not involved.

Q: How many Coinbase users were affected?

A: Coinbase has not given a number. A claim of more than 70,000 users circulated on social media, but Coinbase has called that figure false and it remains unconfirmed.

Q: What happened at Bithumb and Daishin Securities?

A: Bithumb detected abnormal access to an internal employee system on October 27 and was still scoping whether customer data leaked. Daishin Securities reported data on 38,490 customers exposed.

Q: What should users do after a data leak like this?

A: Expect phishing attempts, never share passwords or authentication codes, verify account issues only through the official app or website, and use app-based two-factor authentication or a hardware key.

Source: Coinpedia

Related reading on MM Crypto Analysis Web

• Community Bank Stablecoin Push: OCC Urges Small Lenders to Issue Tokens
• Crypto.com and OG.com Launch CFTC-Regulated 24/7 Perpetuals for US Traders
• Bessent: Treasury Will Use SEC and CFTC Actions to Advance Crypto Rules After CLARITY Stalls

More in Regulation on MM Crypto Analysis Web.