Coinbase said an incident at analytics provider Amplitude affected contact data for a small subset of its customers and that its own systems were not breached. A spokesperson said limited transaction data was also involved. The company has not said how many customers were affected.
Coinbase heads into its third-quarter results on Thursday with a question it would rather not answer on an earnings call.
The exchange said late Tuesday that a security incident at Amplitude, an analytics vendor, "impacted a small subset of Coinbase customer contact data, among other Amplitude customers." Coinbase said it had found "no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted," and that it was notifying affected customers and regulators. "Coinbase has not had a data breach," the company said.
A Coinbase spokesperson later said that "contact and limited transaction data were impacted." The company has not disclosed how many customers were affected. A figure of more than 70,000 users that circulated on social media was disputed by the company, which said it likely came from an AI chatbot that confused the incident with a 2025 breach.
Why vendor risk matters
The incident sits outside Coinbase's own systems, but the data belonged to its customers. For an exchange, exposed contact details matter because they can be used in phishing and impersonation scams aimed at account holders. Coinbase's May 2025 breach also centered on customer data, which is why investors are likely to ask how this one compares.
The case also shows a broader exposure. Exchanges rely on outside vendors for analytics, support and marketing, and each one holds some customer information. Coinbase said other Amplitude customers were affected too.
The results
Coinbase reports after Thursday's close, with a question-and-answer session at 5 p.m. Eastern. Analysts expect revenue of about $1.22 billion and adjusted earnings of about 7 cents a share. The shares closed Wednesday at $162.32, up 0.8%, with bitcoin then above $80,000. Bitcoin has since slipped below that level.
Minor incident or overhang?
The minor-incident view: the exposure was at a vendor, involved contact data and limited transaction data, did not touch customer funds, and Coinbase disclosed it publicly.
The overhang view: the company has not said how many customers were affected, the data can be used to target users, and a second customer-data incident in about 18 months may raise questions about controls and costs.
What to watch
Whether Coinbase quantifies the exposure on the call, any statement from Amplitude, regulatory notices filed by the company, and the quarter's trading volume and subscription revenue.