Third-Party Analytics Breach Exposes User Contact Data

A major cryptocurrency exchange has confirmed that customer contact details were compromised following a security incident at its third-party product analytics provider.

Coinbase reported that its internal infrastructure remains secure and that customer funds, passwords, and private keys were unaffected by the breach. The exposure originated at Amplitude, an analytics vendor, which experienced an incident impacting a small subset of exchange customers alongside other clients. The trading platform is now notifying impacted individuals and regulators as required by law.

Addressing the incident through an official social media account, the exchange pushed back against claims of an internal compromise, noting that the risk stemmed entirely from the vendor.

“We’ve found no evidence of unauthorized access to Coinbase systems,” Coinbase Support stated on X.

Third-Party Vulnerabilities

The scope of the exposed information remains under discussion. On October 28, 2026, an anonymous X account alleged that attackers obtained contact details for more than 70,000 users. This claim was amplified when 23pds, the chief information security officer at the security firm SlowMist, reshared the post. The exchange has not yet confirmed the 70,000 figure or specified exactly which contact fields were accessed, though security experts warn that exposed emails and phone numbers frequently lead to targeted phishing campaigns.

This is not the first time the trading platform has navigated customer data exposure. In May 2025, the company disclosed an insider threat where overseas TaskUs support contractors were bribed to gather records for impersonation scams. That earlier breach impacted roughly 69,461 users and exposed deeper personal information, including names, addresses, and phone numbers. High-profile targets were also caught in the 2025 leak, including Sequoia Capital’s Roelof Botha. Remediation for that incident drew a DOJ investigation and carried estimated costs of $180-400 million.

The timing of the Amplitude disclosure arrived just one day before the exchange's third-quarter financial update, where analysts anticipated revenue near $1.2 billion. As the quarter officially closed on September 30, any potential financial impact from the analytics vendor incident is expected to appear in fourth-quarter reporting rather than the current cycle.

Broader Industry Leaks

The analytics vendor breach coincides with a separate security incident at a South Korean digital asset platform. Bithumb confirmed this week that an unauthorized outside party accessed a mobile groupware system used internally by its employees. The exchange has reported the intrusion to the Korea Internet & Security Agency (KISA).

Bithumb noted that the compromised internal application operates separately from its core trading systems, meaning customer crypto assets cannot be accessed through the breach.

“So far it appears to be focused on internal employee information, but we are analyzing the details while leaving open the possibility that member information was included,” a Bithumb official said.

Historical incidents demonstrate the severe risks of compromised contact data. In 2017, a database stolen from a Bithumb employee's computer exposed emails and phone numbers for approximately 3% of the platform's customers, an event the exchange later connected to phishing-related wallet thefts. Following recent warnings about critical PHP vulnerabilities, researchers at SlowMist emphasize that third-party vendors continue to be the weakest link for digital asset firms that have otherwise hardened their internal systems.