What we know. Coinbase posted the statement on its Coinbase Support X account after SlowMist's 23pds claimed hackers had contact details on more than 70,000 users. Coinbase has not confirmed that number. It has not said how many customers were affected, which contact fields leaked, or when the Amplitude incident happened. It is emailing affected customers and notifying regulators. The other Amplitude customers have not been named, and we have not yet seen a public statement from Amplitude itself. Affected count: Undisclosed.
Why it matters past crypto. Amplitude's tracking code sits inside many company apps and websites, and it sees users, devices and what they click. A leak of emails and phone numbers paired with "this person uses Coinbase" is ready-made phishing bait. Coinbase already lived through this in 2025, when bribed support contractors leaked customer records. It is also the latest in a run of analytics and third-party script incidents this week, after Warp's vendor breach and the Convertr checkout skimmer.
What I'd do today. If you use Amplitude, ask your account team in writing whether your project was in scope and what data was touched. Rotate any Amplitude API keys and review who can export data. Then check what you actually send to it: plenty of teams pipe raw emails, phone numbers or account IDs into analytics events when a hashed ID would do. Keep personal data out of analytics tools, and a breach at that vendor costs you far less.