Original author: Nicky, Foresight News
On October 28, according to DelCrypto and Slow Fog Chief Information Security Officer 23pds, a data leak occurred at Coinbase, with hackers obtaining contact information for over 70,000 users, but it has not been confirmed whether passwords or funds were stolen.
On the same day, Coinbase responded, stating that "there was no data leak." According to their statement, the analytics service provider Amplitude experienced a security incident that affected some Coinbase customer contact data as well as data from other Amplitude customers. The team found no evidence of unauthorized access to Coinbase systems, customer funds were also unaffected, and the company will notify affected customers and regulatory bodies in accordance with legal obligations.
As of the publication date, Amplitude has not responded to this incident.
Who is Amplitude?
Amplitude is a publicly traded company based in the United States that offers a digital product analytics platform, headquartered in San Francisco, with the stock code Nasdaq: AMPL. Its business is to help companies analyze user behavior in Web and Apps, with features including real-time insights, session replay, A/B testing, and data activation, utilizing a SaaS subscription model.
The company originated in 2011 when Spenser Skates and Curtis Liu founded Sonalight, initially creating a voice-to-text application, and entered Y Combinator in the winter of 2012. Due to a lack of effective user behavior analysis tools, the two built an internal analytics system, and subsequently in 2014 officially transitioned to product analytics and launched under the Amplitude brand.
The third co-founder, Jeffrey Wang, joined in the same year, and his prior work experience at Palantir and Sumo Logic helped establish the company’s large-scale data processing capabilities. Skates is currently the CEO, holding a bachelor's degree in Bioengineering from MIT and has won the MIT Battlecode programming competition twice.
Amplitude went public directly on NASDAQ in September 2021, with projected revenue of approximately $343 million for the fiscal year 2025 and about 750 to 800 employees, serving customers ranging from startups to Fortune 100 companies. Notably, AMPL's stock price started to rise from $6.6 in late June, reaching a new annual price high of $17.72 on October 23.
Regarding this incident, as of October 28, there has been no public statement or status page announcement from Amplitude. The company has not previously recorded a large-scale data leak of the platform itself. In the SpotAngels incident in September 2026, a third party accessed some data stored on Amplitude using stolen credentials, but SpotAngels explicitly clarified that the Amplitude platform was not breached.
Amplitude has clear client cases in the finance and crypto fields. Ramp Network is a cryptocurrency deposit and withdrawal platform that extensively uses Amplitude's analytics, experimentation, and session replay features, primarily for product analysis and user journey insights, rather than core funding systems. Xapo Bank is a Bitcoin bank and custody service that uses Amplitude Analytics and Feature Experimentation to optimize the account opening process, also not involving core custody and private key systems.
Other financial clients include the American fintech company Dave, Salt Bank, and several forex and derivatives brokers. For such clients, the risks are generally limited to behavioral analysis data and some contact information, rather than transactions, balances, or private keys, with the primary threat after a leak being phishing, social engineering, and SIM swapping, rather than direct theft of cryptocurrency.
Coinbase stated that the incident affected the data of other Amplitude clients, but has not publicly named other specific companies at this time, nor have Ramp Network, Xapo, or others issued related statements. Affected parties may choose to privately notify users or are still assessing the extent of the impact.
Coinbase has previously faced more serious security incidents
This is not the first time Coinbase has dealt with data and account security issues.
The most severe incident occurred in 2025. According to official disclosures, criminals bribed overseas customer service agents to copy data from the customer support system, involving approximately 69,461 users. The leaked content included names, addresses, phone numbers, emails, last four digits of Social Security numbers, masked bank information, government ID images, account balance snapshots, and transaction history, but did not include passwords or private keys. Attackers primarily used this information to impersonate Coinbase employees and trick users into transferring cryptocurrency.
Coinbase refused to pay a ransom of $20 million, instead offering a reward of the same amount for the capture and conviction of the perpetrators, while also firing related personnel, terminating the partnership with the outsourced customer service provider, and voluntarily compensating retail users who were tricked into transferring coins due to the incident. The company’s second-quarter 2025 financial report confirmed related costs of approximately $307 million, including customer compensation and direct legal costs.
An earlier incident occurred between March and May 2021. Attackers used phishing to obtain emails, passwords, and phone numbers, and exploited a vulnerability in the Coinbase SMS account recovery process to bypass two-factor authentication, resulting in the funds of at least 6,000 accounts being transferred out. Coinbase subsequently fixed the vulnerability and fully compensated the stolen funds at their value at the time of the incident.
The commonality in the two incidents is that the direct losses were ultimately borne by the platform for compensation, but once the data is leaked, the subsequent risks of it being used for phishing and social engineering can persist long-term.
On October 28, Binance founder Zhao Changpeng (CZ) posted on X platform stating that there were four reported data leak incidents on that day, involving not only Coinbase's third-party service provider Amplitude but also the South Korean cryptocurrency exchange Bithumb, as well as South Korean traditional financial institutions Future Assets and Daishin Securities.
CZ pointed out that information leaked from trading platforms, such as names, emails, phone numbers, addresses, identification documents, and transaction records, could be used for phishing, SIM card hijacking, and social engineering attacks. His recommendations focused on account isolation and verification methods: setting independent email addresses and strong passwords for different trading platforms, prioritizing the use of hardware security keys, Passkeys, or authenticators, avoiding reliance on SMS double verification, and enabling withdrawal address whitelists and anti-phishing codes. Furthermore, users should regularly check account login sessions and API key permissions and be alert to scams impersonating customer service.
He also reminded that leaked address and asset holding information could provoke real-life extortion or robbery risks, advising users to avoid publicly revealing personal asset situations.
In addition, observations from multiple organizations indicate that the rapid development of AI is closely related to the recent surge in security incidents, with its primary role not being to create entirely new types of attacks but to significantly lower the threshold for attacks, accelerating the scaling of existing methods.
Research conducted in collaboration with Harvard Kennedy School and Bruce Schneier shows that fully automated personalized spear phishing driven by large models has a click-through rate of about 54%, comparable to that of human experts, and far exceeding the approximately 12% of ordinary phishing, potentially increasing profits from large-scale activities by up to 50 times. Microsoft's report also provides similar click-through rate data. Deepfake audio and videos further amplify these risks.
The pace of exploiting vulnerabilities is also accelerating. Microsoft's report states that the median time from the disclosure of a vulnerability to its weaponization is often less than 24 hours. CrowdStrike's 2026 Global Threat Report indicates that AI-enabled adversarial activities grew by 89% in 2025, with the "breakthrough time" for cybercrime from initial access to lateral movement reduced to an average of 29 minutes. IBM's "Cost of Data Breach Report 2026" notes that about a quarter of malicious breaches are AI-related, with a higher average cost.
Bruce Schneier emphasizes the dual-use of AI: it can efficiently automate phishing while also being used for high-accuracy identification of phishing intentions. He believes that defenders may benefit more in certain areas in the short term, but this is an ongoing arms race. The assessments from organizations like CrowdStrike, Microsoft, and IBM align: AI is optimizing existing tactics such as social engineering, credential theft, and exploitations, rather than opening up entirely new fronts, but the increase in speed and scale of attacks significantly compresses defensive windows.
For the cryptocurrency industry, this trend closely aligns with the events related to Coinbase. The SMS vulnerability in 2021 relied on phishing to obtain credentials, the bribery incident in 2025 was centered on social engineering to trick transfers, and the current Amplitude incident exposes emails and phone numbers, which are raw materials for phishing and social engineering. AI makes these attacks more personalized, multilingual, harder to detect, while lowering costs and expanding target ranges. Supply chain and third-party risks are also further amplified by the reconnaissance and exploitation accelerated by AI.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
