exchange · · 2 outlets
Coinbase reports analytics vendor breach hit small subset of customer contact data, funds unaffected
The exchange, Coinbase, stated that a security incident involving its analytics vendor, Amplitude, impacted a "small subset" of its customers' contact data.
The company asserted that it found no evidence of unauthorized access to its own systems, and it confirmed that customer funds were "not impacted."
Coinbase announced it is informing affected customers and regulatory bodies as required by its legal duties. The firm did not specify the number of customers affected, the nature of the exposed contact data, or the timing of the event.
This situation follows a more severe disclosure by Coinbase in May 2025, when it reported that cybercriminals bribed overseas customer support agents to obtain personal data from fewer than 1% of its monthly transacting users.
The exchange declined a $20 million ransom demand in that prior incident, instead offering a $20 million bounty for information leading to the attackers' capture. A subsequent filing with the Maine attorney general detailed 69,461 affected customers, with exposed data including names, addresses, masked Social Security numbers, and government ID images.
This development underscores a broader industry pattern where crypto firms face customer data exposure through their partners. For instance, Trezor reported a breach at shipping provider ShipMonk that exposed the names, phone numbers, and home addresses of 67,000 U.S. customers, alongside nearly 14,000 disclosed in August, with some records dating back to 2019.
The recurring vulnerability of third-party service providers introduces risks for crypto users, as seen with this vendor-related security incident at Coinbase. Despite the vendor's involvement, customers should remain vigilant against suspicious communications that might exploit the exposed information.
This ongoing pattern of third-party risk requires institutions to maintain strict oversight of their operational partners to safeguard client information.
Why it matters
This incident highlights the ongoing regulatory and security risk posed by third-party vendors in the crypto industry. Regulators and exchanges are increasingly scrutinizing how data is handled by partners, not just internally. Investors should watch how Coinbase manages this disclosure and subsequent regulatory notifications.
