Coinbase confirmed a security incident at one of its suppliers overnight into October 28, 2026. Contact details of some of its customers were exposed, according to the exchange email addresse
Coinbase confirmed a security incident at one of its suppliers overnight into October 28, 2026. Contact details of some of its customers were exposed, according to the exchange email addresses and phone numbers. Passwords, private keys, transaction histories and balances are untouched on the same account, and no unauthorised access was found in the exchange's own systems. The risk to you therefore does not sit in your account but in your inbox: anyone who knows your address and your number, and who also knows you are a customer of a crypto exchange, can approach you with great precision.
The incident is not an attack on a blockchain and not a theft of coins. It belongs to a series of cases that have become more frequent this year, in which the data leaves through a provider's supplier rather than through the provider itself. For those affected the difference is of no practical consequence: the data is out, and it stays out.
Amplitude is a provider of product analytics. An analytics vendor is a company that evaluates for its clients how people use an app or a website, collecting and storing usage data to do so. Such a service is built in through an SDK, a small code package from the vendor that runs inside the client's product and reports events to the vendor's servers.
In technical terms that means the vendor has to be able to tell users apart for the analysis to make any sense. In many cases an anonymous identifier is enough. But as soon as an email address or a phone number is sent along so that evaluations can be matched with the client's own customer records, those details sit with the vendor. That is precisely where the reported incident starts.
Coinbase dates the events to October 27 and 28, 2026 and locates them at Amplitude rather than at itself. According to the exchange, data belonging to other Amplitude clients was affected as well, so this is not a case that hits Coinbase alone. CoinDesk assembled the account on October 28 from a post by Coinbase support on X.
Coinbase speaks of a small share of the contact details. The exchange gives no figure for the number of accounts affected. Expressly excluded, on its account, are passwords, private keys, transaction histories and the balances themselves.
That distinction matters more than it sounds. An email address and a phone number move no balance. They open no account, and they get around no login either. What they deliver is something else: a hit. Anyone holding a list of addresses known to belong to accounts at a large crypto exchange no longer has to cast a wide net. They can write and they can call, and they can do so with a backstory that happens to be true.
That is exactly what separates a contact data breach from a password breach. With a password breach, access is the problem, and the remedy is a new password. With a contact data breach, reachability is the problem, and no new password helps against it, because the address stays the same.
There are two statements on the scale, and they lie far apart. Coinbase sticks to a small share of its customers without a figure. The blockchain security firm SlowMist, whose security chief goes by the name 23pds, described the data set as genuine and spoke of contact details of more than 70,000 users; whether passwords or balances were affected was not established.
Those 70,000 are a third-party figure. Coinbase has not confirmed it, and no independent verification of the number is available so far. To know how large the incident is, you therefore have to live with a range: a small share according to the exchange, more than 70,000 accounts according to a security vendor. One of the two statements will become more precise over the coming days, but not today.
For your own situation the range changes little. Whether 70,000 accounts are affected or considerably fewer does not decide whether you are among them. That is decided by the notification alone, and it runs through a single channel.
Customer data flows through suppliers: every line to a vendor is one more place it can leave through.
Coinbase has announced that it will inform affected customers by email, pointing to its legal obligation. The exchange also says it has reported the incident to the competent supervisory authorities. That matches the reporting by Crypto Briefing, which likewise documents Coinbase's rejection of a breach of its own.
An awkward situation follows from that. The only legitimate route by which the message reaches you is the same email address that may now be exposed, and email is at the same time the channel the imitators use. A message that invokes this data breach is therefore no proof of its own authenticity, only an indication that the subject is public knowledge.
In practice that means you can take the information from such a message, but not the links in it. What the message says can be looked up in the app or through the exchange's address typed in yourself. Follow the link instead and you leave the choice of destination to the sender.
Social engineering describes an attack on the person rather than on the technology: the attacker gets the target to hand over willingly what he could not otherwise obtain. A contact data breach is the ideal raw material for this trick, because it supplies the two things it needs: a route to the victim and a reason why the call is plausible.
The sequence has been the same for years and has barely changed after the large leaks of recent months. Someone gets in touch, names the exchange, knows the registered email address and speaks of a suspicious login attempt. Then comes the urgency, and at the end stands an action that cannot be reversed: a transfer to a supposedly safe address, entering a recovery phrase on a replica page, or passing on a one-time code.
Two features carry furthest. The first is the direction: genuine support responds to a request you made, it does not call unprompted and press. The second is the content of the request. A recovery phrase, a private key and a one-time code have exactly one purpose, which is to grant access. Any party asking for them wants access, and that holds regardless of how convincing the number on the display looks.
Added to that are the smaller signals that count in combination: a sender domain that is only almost right, a link whose destination in the status bar differs from the text, a greeting that stays too general, time pressure that is given no factual basis, and the request not to discuss the matter with third parties. How a forged exchange email can be recognised from these features is set out at length in our overview of phishing after a data breach; that even a genuine-looking sender address is no proof is shown by the case of a phishing email from a genuine sender domain.
No exchange and no wallet manufacturer needs your recovery phrase to unlock an account, cancel an order or release a withdrawal. Just as little does anyone need your one-time code in order to help you; that code exists to confirm a login, and whoever receives it confirms their own. And nobody asks you to send a balance for safekeeping to an address they give you.
The last point deserves a distinction, because the trick leans on something legitimate here. Self-custody is a sensible decision, but it is a planned one, with a wallet you selected and set up yourself, and with an address you generated yourself. To look in advance at which programs are suitable, the comparison of software wallets sets out the differences in backup, recovery and supported blockchains. An address that comes from the other party during a conversation is the opposite of that.
Anyone wanting to cross-check the exchange's account runs into a gap. Amplitude's public status page lists disruptions and maintenance for October 24 to 27, 2026, among them delayed event delivery, maintenance in the US data centre and delays in data ingestion. A security incident for October 27 and 28 is not recorded there.
The only security notice in that period dates from October 22 and concerns vulnerabilities in PHP, a widely used programming language for web applications. Amplitude states there that its own services are not affected by these vulnerabilities, and that the company is working with an affected third-party provider on security updates on that provider's side. Whether this notice is connected to the incident now reported is open; the sources do not support linking the two.
All that can be established is this: the attribution of the incident to Amplitude comes so far from Coinbase alone. An account from the vendor itself on the scale and the number of clients affected is not yet available. For placing the case that is a genuine uncertainty, and it will be resolved only when Amplitude says something itself.
Phone number and email address are the material from which the fake support call draws its credibility.
Coinbase serves the European market on the basis of a MiCA licence from the Luxembourg supervisor CSSF, announced in June 2025 and designed to cover all 27 EU states. MiCA is the EU regulation on markets in crypto-assets; it governs who may offer crypto services in the EU and which obligations come with that. Before it, Coinbase held individual national permissions, Germany included.
For a data breach, however, the General Data Protection Regulation is the governing legal framework rather than MiCA. It obliges the controller to report a breach of personal data protection to the supervisory authority within 72 hours, and requires notification of those affected where there is a high risk to their rights. That Coinbase speaks of a report to supervisory authorities and of emails to those affected fits both of these duties.
A third point is also of practical weight: a processor, meaning a vendor that processes data on instruction, does not release the client from responsibility. Your point of contact remains the exchange, even though the incident sat with its supplier. And anyone unhappy with the response can complain to a data protection authority in their own country of residence; that right does not depend on which EU country the company is based in.
Two-factor authentication requires a second piece of evidence alongside the password, usually a numeric code. Which form that second factor takes decides unusually much after a contact data breach, because a known phone number shifts the attack surface.
A code by SMS is the weakest of the common variants once the number is known. For one thing the code can be elicited by a caller pressing for it to be entered on a replica page. For another there is SIM swapping: here an attacker has the victim's number transferred to a SIM card of their own and receives the codes themselves from then on. Both require the attacker to have the number.
A code from an authenticator app is considerably more robust, because it is generated in the device and does not travel over the mobile network. It offers no protection against a replica login page, though: enter the code there and you have passed it on. Only a passkey or a security key is phishing-resistant. A passkey is a cryptographic login credential that stays on the device and is firmly bound to the address of the genuine website. On a forged domain it does not work, and that is precisely the point: the protection does not depend on you spotting the fake.
Self-custody means that the private keys to your crypto-assets sit with you and not with a provider. Holdings in self-custody cannot be reached through an exchange's supplier, because neither keys nor access sit there. A hardware wallet is the usual device for it: it keeps the key in a chip of its own and does not release it even when signing a transaction.
The price of that independence is that the key risk passes to you. A lost recovery phrase cannot be reset by anyone, and a hardware wallet from an unclear source brings a risk of its own. Many investors therefore separate by purpose: day-to-day trading on a licensed exchange, and the part meant to sit still in their own custody.
For the case at hand today the trade-off is smaller than it sounds in any event. No keys and no balances left. Anyone reconsidering their split now is doing so less because of this incident than because of the regularity with which providers' suppliers end up in the headlines.
In short, this is an incident about contact details rather than balances, and the exchange's account has been consistent on that point so far. Two things remain open: the actual scale, on which Coinbase and SlowMist are far apart, and an account from Amplitude itself. Both are reason to wait for the notification and until then to follow no unsolicited approach.
(As of October 28, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
