Coinbase says an incident at analytics provider Amplitude exposed contact information belonging to a small subset of customers. The exchange found no evidence of unauthorized access to Coinbase systems and said customer funds were not affected.
Amplitude’s 28 October incident update says it detected and contained unauthorized access to a localized portion of its internal systems on 28 September. Event data belonging to fewer than 0.3% of Amplitude customer accounts was affected. That percentage refers to Amplitude customers, not the share of Coinbase users exposed. Powered by Wolfia
Coinbase did not publish the number of affected users or a complete list of exposed fields. It is notifying customers and regulators. Contact data can support targeted phishing and account-recovery fraud even when passwords, private keys and balances remain secure.
Amplitude said an independent forensics firm supported its investigation and that the incident was unrelated to recently disclosed PHP and Node.js vulnerabilities. It also said no end-user information was exposed for customers outside the affected account group.
TOKEN RECON ASSESSMENT
The immediate custody risk appears limited, but the absence of a Coinbase user count prevents a reliable severity estimate. The confirmation threshold is a field-level disclosure, the number and jurisdictions of affected customers and evidence that phishing indicators are being monitored. Users should treat messages invoking this incident as untrusted unless they originate through verified Coinbase channels.
