The short version: Coinbase says a company it uses for website and app statistics, called Amplitude, had a security incident. Coinbase says this exposed contact data for a small group of its customers. Coinbase says it found no evidence that its own systems were accessed without permission, and that customer funds were “not impacted”. The small step today is to watch for fake messages that use the company’s name.
What happened
Coinbase is a company where people buy, sell and store crypto (digital money). On the night of 27 October 2026 (US time), the official Coinbase Support account on X (formerly Twitter) posted a statement. It said Coinbase has not had a data breach. It said Amplitude, “an analytics vendor,” had a security incident. An analytics vendor is an outside company that helps a business count how people use its website or app. The post says the incident affected “a small subset of Coinbase customer contact data, among other Amplitude customers.”
The post goes on: “We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.”
Who is affected
A small group of Coinbase customers. Coinbase has not said how many people.
What we do not know yet
- Which details were exposed. Coinbase’s post says only “customer contact data”. Some news sites say email addresses and phone numbers, but the post does not say that, and Coinbase has not said.
- When it happened.
- Whether scammers are using this data. As of 28 Oct 2026, we found no official statement about that.
- What Amplitude says. As of 28 Oct 2026 we have not found a statement from Amplitude.
Coinbase’s help center has a general page about fake support. It says scammers set up fake support phone lines and pretend to be companies, including Coinbase. That page is not about this incident.
Do this today (under 10 minutes)
- Do not trust messages about this (2 minutes). If an email, text or call says it is from Coinbase, do not tap its links or call its number. Open the Coinbase app, or type the website address yourself, and look there.
- Do not share secrets (1 minute). Coinbase’s help center says its support staff do not ask for your password or 2-step codes (the one-time codes used as a second sign-in check). They also do not ask you to move crypto to a new address. If someone does, hang up or stop replying.
- Look at your 2-step sign-in (about 5 minutes). Open your Coinbase security settings and see which kind of 2-step check you use. Coinbase says hardware security keys are best.
Another day (optional): If Coinbase offers a passkey, a security key or an authenticator app, use one of those instead of text-message codes. Our guide explains authenticator apps: https://safeinai.com/2026/10/25/authenticator-apps/ Coinbase’s help center also suggests “withdrawal allow-listing,” which allows transfers only to wallets you know.
If you lost money or gave someone a code, contact Coinbase through its official help center. Getting money back is not guaranteed.
Sources
- Coinbase Support (official account on X), post of 27 Oct 2026 US time (28 Oct 2026, 02:49 UTC; read in full 28 Oct 2026): https://x.com/CoinbaseSupport/status/2115274731310002356
- Decrypt, 28 Oct 2026 (press, not used as the basis for any Coinbase claim): https://decrypt.co/382009/coinbase-customer-data-hit-in-analytics-vendor-breach-funds-not-impacted
- PYMNTS, 28 Oct 2026 (press, not used as the basis for any Coinbase claim): https://www.pymnts.com/cybersecurity/2026/coinbase-customer-data-exposed-in-vendors-breach/
- CoinDesk, 28 Oct 2026 (press, not used as the basis for any Coinbase claim): https://www.coindesk.com/tech/2026/10/28/coinbase-says-customer-funds-are-safe-after-third-party-vendor-exposes-customer-contact-info
- Coinbase Help, “Technical support and impersonation scams” (official, general page): https://help.coinbase.com/en/coinbase/privacy-and-security/avoid-scams/tech-support-scams
Checked: 30 Oct 2026. This entry will change if Coinbase or Amplitude publish more. Our disclosure: SafeinAI has no affiliate links and earns nothing from the sites or tools named on this page. If this ever changes we will say so here, on this page.
Leave a Reply