Coinbase and Bithumb Disclose Security Breaches Linked to Vendors and Staff Systems
Coinbase and Bithumb Report Isolated Security Incidents – User Asset Protection Confirmed Despite Data Exposure Risks
Key Takeaways
- Analytics vendor Amplitude suffered a security incident impacting a small subset of Coinbase customer contact data.
- Unverified claims circulated on social media suggest over 70,000 users might be affected by the Amplitude breach.
- South Korean exchange Bithumb reported unauthorized access to a mobile groupware system used internally by employees.
- Both cryptocurrency exchanges confirm that their core trading systems remain intact and customer funds are secure.
Analytics Vendor Amplitude Compromised in Recent Breach
Coinbase disclosed a security incident involving its analytics provider, Amplitude. The breach exposed contact information belonging to a small subset of Coinbase customers. The exchange published a brief statement from its official support account on X on October 28, 2026. This communication confirmed that the security issue originated entirely at the vendor level.
Internal Coinbase systems experienced no unauthorized access during the event. The company emphasized that all customer funds remain completely safe. The initial disclosure did not specify which exact contact fields were exposed in the leak. Amplitude services multiple clients, and the breach impacted other companies using the analytics platform alongside Coinbase.
An anonymous account on X claimed that attackers obtained details for more than 70,000 users. The chief information security officer at security firm SlowMist, known as 23pds, reshared this specific claim. Coinbase has not verified or confirmed this numerical figure. BeInCrypto requested an official comment from the exchange regarding the exact scale of the exposure.
Security Disclosure Arrives Immediately Before Quarterly Earnings
The timing of the data breach disclosure aligns closely with the next financial update from Coinbase. The exchange is scheduled to report its third-quarter financial results after the market closes on Thursday. Financial analysts currently expect the company to post revenue near $1.2 billion for the period. Market observers will watch the Thursday update to see if the company provides any cost estimates related to the security incident.
The third financial quarter officially closed on September 30. The Amplitude security incident occurred after this closing date. Any financial impact or remediation costs associated with the breach would more likely appear in the fourth-quarter results. The upcoming presentation will clarify whether this vendor breach registers on the official books of the exchange.
Bithumb System Breach Contained to Mobile Groupware Platform
Coinbase is not the only major cryptocurrency platform managing a data leak this week. South Korean exchange Bithumb confirmed that an unauthorized outside party accessed a mobile groupware system. Employees use this specific system internally for organizational tasks. The exchange promptly reported the unauthorized access to the Korea Internet & Security Agency.
A Bithumb official stated that the breach appears focused on internal employee information. The exchange continues to analyze the specific details of the system intrusion. Management is leaving open the possibility that customer member information was included in the accessed data. The investigation remains active as authorities review the extent of the internal network compromise.
The compromised work system sits completely apart from the main Bithumb trading engine. Customer crypto assets cannot be reached through this specific internal employee breach. Bithumb assured users that the separation of internal operations and trading infrastructure protected all digital assets from unauthorized withdrawal.
Past Incidents Demonstrate Phishing and Impersonation Risks
Both exchanges have faced challenges involving customer data exposure in the past. Coinbase reported an incident in May 2025 where criminals bribed overseas support contractors. The perpetrators gathered customer records specifically to conduct impersonation scams. This history illustrates how threat actors actively attempt to turn customer data against platform users.
Bithumb experienced a related incident almost a decade earlier. A database stolen from an employee computer in 2017 exposed phone numbers and emails for about 3% of total customers. Bithumb later connected subsequent cryptocurrency wallet thefts directly to targeted phishing attacks utilizing that stolen contact data. These historical events underscore why leaked contact details can eventually turn into financial losses for individual account holders.
Our Assessment
The simultaneous security disclosures from Coinbase and Bithumb highlight the distinct vulnerabilities present in third-party vendor platforms and internal employee systems. Both exchanges successfully protected their core trading engines and customer crypto assets during these events. The unverified claim of 70,000 affected Coinbase users remains an open question pending official confirmation.
Past incidents at both companies show that exposed contact information frequently leads to secondary phishing attempts and impersonation scams. Users of these platforms face potential communication risks despite the safety of their underlying financial deposits.
