Coinbase has confirmed that customer contact information was exposed following a security incident at Amplitude, a third-party analytics vendor. The cryptocurrency exchange clarified late Tuesday that its own internal systems were not breached and that customer funds remain secure.
Amplitude Security Incident Details
The company addressed the situation in a post on the social media platform X. Coinbase support stated that Amplitude experienced a security incident that impacted a small subset of Coinbase customer contact data, alongside data from other Amplitude clients.
“We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted,” the company said in its statement. Coinbase added that it is notifying affected customers and regulatory agencies in compliance with legal obligations.
This disclosure comes amid a broader wave of security challenges for the cryptocurrency industry. Recent findings from CoinGecko indicate that hacks and thefts have cost crypto platforms more than $3.6 billion over the previous 18 months.
Third-Party Cyber Risks
The CoinGecko report highlighted that most of these incidents occurred despite companies having performed security audits. The research found that audits often fail to capture the full spectrum of risk, as most exploits target external infrastructure, unaudited code updates, or systemic features manipulated via governance attacks.
Surprisingly, only about 11% of these incidents involved in-scope smart contract flaws, though these specific flaws still resulted in $396 million in losses.
Research by PYMNTS Intelligence on the dangers of third-party vendor breaches further illustrates the threat. The report noted that fraudsters frequently use social engineering tactics, such as impersonating a familiar vendor to trick employees into paying bogus invoices.
“Very often, hackers use social engineering to breach third-party vendors or suppliers as the first step in an attack,” the report stated. By compromising a trusted partner, attackers can initiate malicious contact with target companies using stolen email accounts or open software backdoors into otherwise well-protected systems.
The data showed that 38% of fake invoice scams stemmed from compromised vendors or suppliers, while 43% of phishing incidents had their roots in third-party breaches.
Source: PYMNTS
