Markets · Exchanges
Coinbase says Amplitude vendor incident hit a small subset of customer contact data
In an Oct. 27 @CoinbaseSupport post, Coinbase framed the episode as an Amplitude analytics-vendor security incident, said it found no evidence of unauthorized access to Coinbase systems, said customer funds were not impacted, and said it is notifying impacted customers and regulators.
Coinbase said late Oct. 27 that it "has not had a data breach," and that Amplitude, an analytics vendor, "experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers," according to an official @CoinbaseSupport post at about 10:49 p.m. ET [1]. That framing is the company's. The post did not publish a headcount of affected Coinbase customers beyond "small subset," and Le Coin is not inventing one.
The same statement separates the vendor episode from Coinbase's own stack. "We've found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted," @CoinbaseSupport wrote [1]. On process, Coinbase said it is "notifying impacted customers and regulatory agencies in accordance with our legal obligations" [1]. Those lines are quoted as company claims, not as independent findings.
Vendor scope, as Coinbase states it
Amplitude appears in the statement only as the analytics vendor that experienced the security incident [1]. Coinbase's public claim is limited to a small subset of customer contact data among other Amplitude customers [1]. The post does not name which contact fields were in that subset, does not describe Amplitude's attacker or timeline, and does not assert that Coinbase production systems were entered [1].
A Le Coin pack pull of status.coinbase.com and the Coinbase blog index on the morning of Oct. 28 did not surface a matching Amplitude customer-contact incident notice on either page. The public record for this item, as of that pull, remains the Oct. 27 Support post [1].
The objection
A fair objection is that the whole account rests on one company statement. "Small subset," "no evidence" of Coinbase-system access, and "funds were not impacted" are Coinbase's words, not a third-party forensics report Le Coin can check [1]. Another limit is the missing count: without a published number of customers or a field-level inventory, readers cannot size the contact-data set from this post alone [1].
The tell
What would change the view is a fuller company notice that states which contact fields were involved, how many Coinbase customers sit in the notified set, and whether any independent review still finds no Coinbase-system access [1]. Until then, the public record is the Oct. 27 Support framing: vendor incident at Amplitude, small-subset contact data, no evidence of Coinbase-system access, funds not impacted, and notifications to customers and regulators underway [1].
Sources
- Coinbase Support (@CoinbaseSupport), X statement, Oct. 27, 2026, ~10:49 p.m. ET (created_at 2026-10-28T02:49:30.000Z; status 2115274731310002356), https://x.com/CoinbaseSupport/status/2115274731310002356 ; "Coinbase has not had a data breach."; Amplitude analytics vendor security incident impacted a small subset of Coinbase customer contact data among other Amplitude customers; no evidence of unauthorized access to Coinbase systems; customer funds not impacted; notifying impacted customers and regulatory agencies; accessed Oct. 28, 2026, ~6:20 a.m. ET.
Holding the Corner.
Not financial advice.