Coinbase Blames Vendor for Data Exposure

The Nasdaq-listed crypto exchange said the incident was not a hack of Coinbase itself. In a statement carried by Coinbase Support’s X account and reported by CoinDesk, the company said its systems had not detected unauthorized access and that the exposed information came from Amplitude, an analytics provider.

That distinction matters, but only up to a point. “Not our systems” helps explain where the failure occurred; it does not make the fallout much less useful to scammers. CoinDesk reported that funds, passwords and private keys were not compromised. Even so, exposed email addresses and phone numbers are enough to feed phishing and social-engineering campaigns, especially when the target already expects messages from a financial platform.

Coinbase said it is notifying affected customers by email as required by law. What it did not provide, based on the information reported by CoinDesk, is a count of how many customers were affected or exactly which contact-data fields were exposed. “Small subset” is reassurance phrased as a category rather than a number.

The episode is a clean example of supply-chain risk. A company can avoid unauthorized access to its own systems and still leave customers dealing with the consequences of a vendor’s lapse. In crypto, where users are already trained to fear direct theft, the less cinematic threat is often the more familiar one: a convincing message landing in the right inbox at the right time.