Cryptocurrency exchange Coinbase denied that its internal systems were breached after crypto blogger DelCrxpto alleged on Oct. 28, 2026, that attackers had obtained contact details for more than 70,000 Coinbase customers. The company confirmed an information security incident at third-party analytics provider Amplitude, while saying customer funds were unaffected.

In an Oct. 28 post, DelCrxpto said there was no information indicating that passwords had been compromised or funds stolen. SlowMist’s chief information security officer, known by the pseudonym 23pds, later drew attention to the alleged leak, but provided no independent technical evidence supporting the reported scale.

Coinbase said the incident occurred at Amplitude, which provides analytics services, and rejected claims that its own infrastructure had been compromised.

“Coinbase did not have a data leak. Amplitude, an analytics services provider, experienced a security incident that affected a small portion of Coinbase customers’ contact details, as well as those of other Amplitude clients,” the statement said.

“We have not identified any evidence of unauthorized access to Coinbase systems. Customer funds were not affected,” the company added.

Coinbase said it is notifying affected customers and relevant regulators in accordance with legal requirements. It did not disclose the number of customers affected, the scope of the compromised data or the circumstances of the incident. DelCrxpto’s estimate of more than 70,000 affected users therefore remains unconfirmed by the company.

Although there were no reports of stolen cryptoassets, attackers could use exposed contact information for phishing and social-engineering schemes, including attempts to impersonate exchange staff and gain access to customer accounts.

Previous Coinbase data breach

Coinbase faced a separate large-scale leak of personal information in May 2025. In that incident, attackers bribed outsourced customer-support staff working outside the United States and obtained user information, including know-your-customer data.

The attackers later demanded $20 million from Coinbase in exchange for not disclosing the stolen data. The exchange refused to pay and established a reward fund for information leading to the arrest of those involved. Coinbase estimated that remediation and customer compensation could cost between $180 million and $400 million.

The U.S. Department of Justice launched an investigation into that incident. Coinbase was not a target of the investigation.

Source: Incrypted