Coinbase stated on Wednesday that a security incident at analytics vendor Amplitude exposed the contact information of a "small subset" of its customers. The exchange explicitly denied that its own systems were breached and confirmed that customer funds remained unaffected. Coinbase Support communicated this update via X, noting that other Amplitude clients were also impacted by the vendor-side incident.
This disclosure occurred alongside separate cyberattack reports affecting traditional financial firms and crypto exchanges in South Korea, including an investigation into Bithumb’s internal work platform and a data leak at Daishin Securities involving 38,490 customers. Cointelegraph contacted Coinbase for specific figures on affected users but received no response prior to publication. This event follows a May 2025 breach disclosed by Coinbase, which impacted less than 1% of monthly transacting users and carried estimated remediation costs of up to $400 million.
The incident highlights the persistent supply-chain risks inherent in centralized exchanges, where third-party vendors like Amplitude serve as critical nodes for data processing and analytics. While Coinbase successfully insulated its core ledger and fund custody from compromise, the exposure of customer contact details through a vendor underscores how peripheral infrastructure can still generate significant reputational and operational friction. The distinction between a system breach and a vendor data leak is technically vital for security posture but may offer little comfort to users concerned about privacy erosion.
Regulators and institutional observers will likely scrutinize how exchanges manage vendor due diligence and incident response protocols, especially given the concurrent breaches at South Korean firms. The lack of immediate transparency regarding the exact number of affected users contrasts with the detailed cost estimates provided after the May 2025 incident, suggesting a potential shift in communication strategy or ongoing assessment complexities. As exchanges integrate more external tools for compliance and analytics, the attack surface expands beyond their direct control, necessitating stricter contractual safeguards and real-time monitoring of partner ecosystems.
