Key takeaways
- Coinbase says analytics vendor Amplitude's security incident exposes contact data of a small subset of its customers.
- Coinbase finds no evidence of unauthorized access to its systems and says customer funds are not impacted.
- Coinbase does not say how many customers are affected and is notifying impacted customers and regulatory agencies.
Coinbase said some customers' contact information was exposed in a security incident at analytics vendor Amplitude, while denying that its own systems had been breached. Coinbase Support said on X that the incident impacted a small subset of Coinbase customer contact data, along with data of other Amplitude clients.
Coinbase said it found no evidence of unauthorized access to Coinbase systems, that customer funds were not impacted, and that it is notifying impacted customers and regulatory agencies. Coinbase Support wrote:
"Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations."
The Number Coinbase Has Not Given
Coinbase has not said how many customers were affected. Cointelegraph contacted Coinbase to find out but had not received a response by publication. Until that figure appears, affected customers can only wait for a notice from Coinbase, which says it is notifying impacted customers and regulatory agencies.
The Coinbase disclosure added to reports of cyberattacks affecting exchanges and traditional financial firms, including Bithumb, which is investigating whether a breach of its internal work platform exposed customer information.
A Vendor Breach by Another Name
The Amplitude episode highlights the contested question of where a company's responsibility ends when a supplier is compromised. Coinbase draws the line at its own systems, where it found no evidence of unauthorized access, yet a small subset of Coinbase customer contact data still sat with Amplitude when the analytics vendor was hit.
For customers in that small subset, the label changes little. Their contact data is exposed whether Coinbase calls the Amplitude incident a vendor security incident or a data breach, and Coinbase is notifying impacted customers either way.
Why It Matters
Coinbase says it has not had a data breach, yet a small subset of Coinbase customer contact data leaked through Amplitude, the analytics vendor that held it. We think the label matters less than the incentive: an exchange that collects identity records and shares customer data with third parties multiplies the surveillance surface, and the customer, not the vendor, carries the phishing risk. Customer funds were not impacted this time, but custody at an exchange still ties your coins to your name in every database that data touches. Bitcoin held in self-custody, bought with as little personal data as possible, is the setup where a vendor leak has the least of yours to expose.
