Coinbase says customer funds are safe after a security incident at one of its vendors exposed contact details for some users. That is reassuring, but it is not the end of the story. Email addresses and phone numbers are exactly what scammers need to send convincing fake "Coinbase support" messages. If you hold crypto on the exchange, expect some suspicious texts, emails or calls, and decide now how you will handle them.
What happened
On Tuesday night, 28 October 2026, the Coinbase Support account on X said the exchange had not suffered a data breach. According to Coinbase, the problem began at Amplitude, an analytics provider. Amplitude had a security incident that affected a "small subset" of Coinbase customer contact data, along with data from other Amplitude clients.
Coinbase says it has found no evidence that anyone gained unauthorized access to its own systems, and that customer funds were not impacted. According to CoinDesk and Decrypt, it is notifying affected customers and regulators, as the law requires. CoinDesk reports that customers are being told by email.
Several details are still missing. Coinbase has not said how many customers were affected, which contact fields were exposed, when the incident took place, or which other companies use the same vendor.
Why "funds are safe" is only half the answer
Both statements can be true at once: your money is untouched, and you are now a more likely target. CoinDesk points out that even when passwords, private keys and funds are not compromised, exposed emails and phone numbers are useful raw material for phishing and social-engineering attacks.
Phishing means a message designed to trick you into clicking a link or handing over information. Social engineering is the wider habit of manipulating a person rather than hacking a machine. A scammer who knows your name, email or number can pose as the exchange, and the message looks more believable when it arrives on the contact details you really gave Coinbase.
CoinDesk describes this as a supply-chain risk: you can be exposed through a third party even when the company you trust has kept its own systems secure. You cannot audit the vendors a company uses, so the practical defence is how you respond to messages.
This is not the first time
Customer data held by crypto firms and their partners has leaked before. Decrypt notes that in May 2025 Coinbase disclosed a much more serious incident, in which cybercriminals bribed overseas support agents to steal personal data. Coinbase said it affected less than 1% of its monthly transacting users. It refused a $20 million ransom demand and offered a $20 million bounty for information leading to the attackers' arrest. A later filing with the Maine attorney general counted 69,461 affected customers, with names, addresses, masked Social Security numbers and government ID images exposed.
Decrypt also recalls a September case in which hardware wallet maker Trezor said a breach at its shipping provider, ShipMonk, exposed names, phone numbers and home addresses of 67,000 U.S. customers. That was on top of nearly 14,000 disclosed in August. Trezor warned those customers to watch for fake emails, calls and letters.
| Incident | What was exposed | What it means for you |
|---|---|---|
| Amplitude vendor incident (October 2026) | Contact data for a "small subset" of Coinbase customers; exact fields not stated | Expect fake support texts, emails and calls using your email or number |
| Coinbase support-agent bribery (disclosed May 2025) | Names, addresses, masked Social Security numbers, government ID images; 69,461 customers per a Maine filing | Scammers may know enough personal detail to sound convincing |
| Trezor / ShipMonk (August and September) | Names, phone numbers, home addresses; about 67,000 U.S. customers plus nearly 14,000 earlier | Fake emails, calls and letters; some risk to physical security |
What this means for you: a practical checklist
You do not need to panic or close your account. You do need a few fixed habits, so that when a message arrives you are not deciding under pressure.
- Treat every unexpected message as suspect. That includes texts, emails, calls and social media messages that say they are from Coinbase, whether they mention a hack, a locked account, a suspicious withdrawal or a "security upgrade".
- Verify through the official app. Do not tap links in a message and do not call numbers it gives you. Open the Coinbase app yourself, or type the address into your browser, and check whether any alert or request appears there.
- Never share your password, 2FA codes or recovery phrase. No genuine support process needs them. A recovery phrase gives full control of a wallet to whoever holds it, and a one-time 2FA code is the last barrier between a scammer and your account.
- Be wary of urgency. Scams push you to act in minutes. A real problem can wait while you check it properly.
- Do not move funds to a "safe wallet". If anyone, however official they sound, tells you to transfer crypto to protect it, that is a scam.
- Check your account security settings. Make sure your password is unique to this account and that two-factor authentication is switched on, ideally with an authenticator app rather than text messages.
- Look at your email for the notice. If you are affected, Coinbase says it is notifying customers by email. Even so, reach your account through the app or the official site rather than through links in that email.
Warning signs of a fake support message
Scam messages vary, but they tend to share a few features. They arrive unprompted. They create fear, for example by claiming your account was breached or a withdrawal is pending. They ask you to click, call or "verify" something. They want a code, password or phrase. And they may use accurate personal details, which is why a correct name or number proves nothing about who is writing.
Decrypt quotes cybercrime consultant David Sehyeon Baek, who said earlier this year that a letter with a name and home address signals "we can locate you." He also said stolen data stays useful for years, because people rarely move or change their numbers. In practice, a leak from today can be used in scams long after the headlines fade, so keep your guard up for months, not days.
A wider pattern, not just one exchange
The Coinbase news arrived as several financial firms in South Korea also reported data problems. According to CoinDesk, Daishin Securities said personal information on 38,490 customers, including names, emails and mobile numbers, was hacked. Bithumb customers also had some personal information leaked, according to Yonhap News Agency, and financial authorities have started an inspection of a data breach at Mirae Asset Global Investments. The lesson for ordinary holders is that scam risk follows your data wherever it is stored, so the same habits apply to every exchange, broker and wallet service you use.
FAQ
Was my Coinbase money stolen in the Amplitude incident?
According to Coinbase, no. It says customer funds were not impacted and that it has found no evidence of unauthorized access to its own systems. The exposure involved contact data held by Amplitude, an analytics vendor. Coinbase has not said exactly which details were exposed.
How do I know if a message from Coinbase is real?
Do not judge it by how it looks, since scammers can copy logos and wording. Ignore the links and phone numbers in the message and open the official app yourself to see whether there is a matching notice or request. If nothing appears there, treat the message as a scam.
What should I do if I already shared a code or recovery phrase?
Act quickly. Contact support only through the official app or website, and secure your email and account passwords from a device you trust. If you gave away a recovery phrase, assume that wallet is compromised. Move any remaining assets to a new wallet with a fresh phrase, created on a clean device, and never reuse the old one.
Sources
- CoinDesk: Coinbase says user funds are safe after third-party vendor exposes customer contact info
- Decrypt: Coinbase Customer Data Hit in Analytics Vendor Breach, Funds ‘Not Impacted’
Photo: RDNE Stock project / Pexels
I'm an Italian creator who builds apps, games and websites. I run Crypto Radar Daily with the help of AI tools: every article starts from the sources linked above, and I check what goes out. I'm not a doctor, a lawyer or a financial adviser. Spotted a mistake or have an idea? Write to me.
Instagram @spartaco_94_My websiteWrite to meAbout this blog