CybersecuritySmall-business IT

"Coinbase Got Hacked"? What Coinbase and Its Analytics Vendor Amplitude Actually Say

Coinbase says its systems weren't breached; analytics vendor Amplitude says an intrusion hit under 0.3% of its accounts. What happened and the vendor lesson.

By Cybercave Technologies, LLC · Oct 29, 2026

The word PHISHING spelled in cut-out letters on an orange-striped background — Phishing concept photo. Credit: Photo by Ann H via Pexels (Pexels License).

Short answer: Coinbase says it was not breached. It says a security incident at Amplitude, an analytics company it uses, exposed contact data for a "small subset" of Coinbase customers. Amplitude says it caught and shut down an intrusion on September 28, 2026, affecting event data for under 0.3% of its customer accounts. The lesson for any business: your customers' data is only as safe as the vendors you send it to.

Key points

Coinbase says its own systems and customer funds were not touched (as of October 29, 2026).
Coinbase calls a viral "70,000 users" figure false. No official count has been released.
Leaked emails and phone numbers are fuel for phishing. Expect fake "Coinbase" messages.
Check what customer data your own website and apps send to analytics tools.

What happened?

Coinbase's support account posted on the evening of October 27, 2026 (ET) that the exchange "has not had a data breach" and that an incident at Amplitude affected some Coinbase customer contact data, along with other Amplitude customers, as reported by Decrypt and CoinDesk. Coinbase said it has seen no sign that anyone got into its own systems, and that it is telling affected customers and regulators.

In statements to Unchained and Cointelegraph, a Coinbase spokesperson said "contact and limited transaction data" were affected, but not home addresses or anything that would let someone directly get into an account or move funds.

What does Amplitude say?

Amplitude posted a customer update on its Trust Center saying its security team detected, contained and fixed unauthorized access to "a localized portion" of its internal systems on September 28, 2026. Amplitude says the intrusion reached event data for fewer than 0.3% of its customer accounts, that it contacted each of those customers, and that an outside forensics firm found no end-user data exposed for any other Amplitude customer. Amplitude also says the incident is unrelated to the recent PHP and Node.js vulnerabilities.

Neither company has said publicly how many Coinbase customers were affected or which exact fields were exposed (as of October 29, 2026, 6:29 AM ET).

Where did the "70,000 users" number come from?

It isn't from Coinbase or Amplitude. According to Unchained, an X account posted the 70,000 figure without a source about three hours before Coinbase's statement, and it spread from there. A Coinbase spokesperson called it "false" and said the company believed it came from an AI chatbot mixing this incident up with Coinbase's May 2025 case. Unchained said it could not independently confirm how the number started. Coinbase also told BeInCrypto the figure was inaccurate.

That earlier case was different: in May 2025, Coinbase said criminals paid off overseas support workers to hand over customer data, a separate incident Cointelegraph notes affected under 1% of its monthly transacting users.

Who is at risk now?

Mostly people whose contact details were exposed, and the risk is phishing, not drained accounts. Contact data is exactly what scammers need to send convincing fake "security alert" emails and texts. CoinDesk made the same point: exposed emails and phone numbers can feed social-engineering attacks even when passwords and funds are safe.

Why should a Michigan small business care?

Because you probably do the same thing Coinbase did: send customer data to outside tools. Website analytics, booking widgets, email marketing and chat plugins can all receive names, emails or phone numbers. If one of those vendors is breached, your customers get the scam messages, and they may blame you.

What should a small business do this week?

Open your website in a browser, then use the developer tools' Network tab to see what your analytics and marketing tags send. Then:

List every outside tool that receives customer emails or phone numbers.
Turn off sending personal details to analytics tools unless you truly need them.
Check each vendor's security or "trust" page and how it says it will notify you of an incident.
Warn customers that you will never ask for passwords or codes by email or text.

For more, see our guides to spotting fake recruiter and login scams, what a vendor storing ID data means for you, and checking that your backups actually restore.

FAQ

Were Coinbase passwords or crypto stolen? Coinbase says no: it has seen no sign of anyone getting into its systems and says funds were not affected. Its spokesperson said the exposed data would not let someone directly access an account.

Is the 70,000-user figure real? Coinbase says it is false. Neither Coinbase nor Amplitude has released an official count.

I use Coinbase. What should I do? Treat any unexpected "Coinbase" email, text or call as suspect, and go to the app or website directly instead of clicking links. Use an authenticator app or security key rather than SMS codes where you can.

Is Amplitude still safe to use? Amplitude says the intrusion was contained on September 28 and that no end-user data was exposed for customers outside the affected group. If you use it, review what personal data you send it.

Disclosure: Cybercave Technologies has no business relationship with Coinbase or Amplitude, holds no position in either company, and was not paid for this article. This is not investment advice. Not sponsored.