Coinbase Rushes to Debunk Rumors! 4 Breaches on the Same Day—Is AI Destroying Crypto Security?

Author: Nicky, Foresight News

On October 28, according to DelCrxpto and SlowMist Chief Information Security Officer 23pds, a data breach occurred at Coinbase, with hackers obtaining the contact information of over 70,000 users, though it has not yet been confirmed whether passwords or funds were stolen.

On the same day, Coinbase responded, stating that "no data breach occurred." According to its statement, analytics service provider Amplitude suffered a security incident that affected some Coinbase customer contact data as well as data of other Amplitude customers. The team found no evidence of unauthorized access to Coinbase systems, and customer funds were not affected. The company will notify affected customers and regulators in accordance with legal obligations.

As of publication, Amplitude has not yet responded to this incident.

Who is Amplitude?

Amplitude is a U.S.-listed company that provides a digital product analytics platform, headquartered in San Francisco, with the stock ticker Nasdaq: AMPL. Its business is helping enterprises analyze user behavior across the Web and apps, with features including real-time insights, session replay, A/B testing, and data activation, operating on a SaaS subscription model.

The company originated from Sonalight, founded in 2011 by Spenser Skates and Curtis Liu, which initially built a voice-to-text messaging app and entered Y Combinator in the winter of 2012. Due to the lack of effective user behavior analytics tools, the two built an internal analytics system themselves, then formally pivoted to product analytics in 2014 and launched under the Amplitude brand.

A third co-founder, Jeffrey Wang, joined the same year; his prior experience at Palantir and Sumo Logic helped the company build large-scale data processing capabilities. Skates currently serves as CEO, holds a bachelor's degree in biological engineering from MIT, and has twice won the MIT Battlecode programming competition.

Amplitude went public directly on Nasdaq in September 2021, with revenue of approximately $343 million in fiscal year 2025, around 750 to 800 employees, and customers ranging from startups to Fortune 100 enterprises. Notably, AMPL's stock price began rising from $6.6 in late June and hit a new full-year high of $17.72 on October 23.

Regarding this incident, as of October 28, no official statement or status page announcement from Amplitude has been seen in public information. The company also has no prior public record of a large-scale data breach of its own platform. In the September 2026 SpotAngels incident, a third party used stolen credentials to access some data stored on Amplitude, but SpotAngels explicitly clarified that the Amplitude platform itself was not compromised.

Amplitude has clear customer cases in the finance and crypto sectors. Ramp Network is a crypto on-ramp/off-ramp platform that heavily uses Amplitude's analytics, experimentation, and session replay features, primarily for product analytics and user journey insights rather than core fund systems. Xapo Bank is a Bitcoin bank and custodian that uses Amplitude Analytics and Feature Experimentation to optimize its account opening process, likewise not involving core custody and private key systems.

Other financial customers include U.S. fintech company Dave, Salt Bank, and some forex and derivatives brokers. For such customers, the risk is mainly limited to behavioral analytics data and some contact information, rather than transactions, balances, or private keys; the primary threats after a leak are phishing, social engineering, and SIM swapping, rather than direct theft of coins.

Coinbase stated that the incident affected the data of other Amplitude customers, but has not publicly named other specific companies so far, and Ramp Network, Xapo, and others have not issued related statements. Affected parties may choose to notify users privately or may still be assessing the scope of impact.

Coinbase Has Experienced More Serious Security Incidents Before

This is not the first time Coinbase has faced data and account security issues.

The most serious one occurred in 2025. According to official disclosures, criminals bribed overseas customer service agents to copy data from the customer support system, involving approximately 69,461 users. The leaked information included names, addresses, phone numbers, emails, the last four digits of social security numbers, masked bank information, images of government ID documents, account balance snapshots, and transaction history, but did not involve passwords or private keys. Attackers mainly used this information to impersonate Coinbase employees and trick users into transferring out crypto themselves.

Coinbase refused to pay a $20 million ransom, instead setting up a bounty of the same amount for the capture and conviction of those responsible, while dismissing the personnel involved, cutting ties with the outsourced customer service provider, and voluntarily compensating retail users who were tricked into transferring coins due to the incident. The company's Q2 2025 financial report confirmed related costs of approximately $307 million, including customer compensation and direct legal costs.

An earlier one occurred between March and May 2021. Attackers obtained emails, passwords, and phone numbers through phishing, exploited a vulnerability in Coinbase's SMS account recovery process to bypass two-factor authentication, and funds were transferred out of at least 6,000 accounts. Coinbase subsequently fixed the vulnerability and fully compensated the stolen funds at the value at the time of the incident.

The common thread between the two incidents is that the direct losses were ultimately borne by the platform, but once data flows out, the subsequent risk of it being used for phishing and social engineering will persist for a long time.

On October 28, Binance founder Changpeng Zhao (CZ) posted on X that a total of 4 data breach incidents were reported that day, including, besides Coinbase third-party service provider Amplitude, South Korean crypto exchange Bithumb, as well as South Korean traditional financial institutions Mirae Asset and Daishin Securities.

CZ noted that information leaked from trading platforms, such as names, emails, phone numbers, addresses, identity documents, and transaction records, could be used for phishing, SIM card hijacking, and social engineering attacks. His advice focused on account isolation and verification methods: set up separate emails and strong passwords for different trading platforms, prioritize hardware security keys, Passkeys, or authenticator apps, avoid relying on SMS two-factor authentication, and enable withdrawal address whitelists and anti-phishing codes. In addition, users should regularly check account login sessions and API key permissions, and be wary of scams impersonating customer service.

He also warned that leaked home addresses and asset holdings could lead to real-world extortion or robbery risks, and users should avoid publicly disclosing their personal asset situation.

In addition, according to observations by multiple institutions, the rapid development of AI is closely related to the high frequency of security incidents in recent years; its main role is not to create entirely new types of attacks, but to significantly lower the barrier to attacks and accelerate the scale-up of existing methods.

Research by Harvard Kennedy School in collaboration with Bruce Schneier shows that personalized spear phishing fully automated by large models has a click-through rate of about 54%, on par with human experts and far higher than the roughly 12% of ordinary phishing, and can increase the profits of large-scale campaigns by up to about 50 times. Microsoft's report also gives similar click-through rate data. Deepfake voice and video further amplify such risks.

The pace of vulnerability exploitation is also accelerating. Microsoft's report states that the median time from a vulnerability becoming public to being weaponized is often less than 24 hours. CrowdStrike's 2026 Global Threat Report shows that AI-enabled adversary activity grew 89% in 2025, and the "breakout time" for cybercrime—from initial access to lateral movement—dropped to an average of 29 minutes. IBM's "Cost of a Data Breach Report 2026" points out that about a quarter of malicious breaches are AI-related, and the average cost is higher.

Bruce Schneier emphasizes the dual-use nature of AI: it can efficiently automate phishing and can also be used to identify phishing intent with high accuracy. He believes that in the short term defenders may benefit more in some respects, but this is an ongoing arms race. CrowdStrike, Microsoft, IBM, and other institutions are consistent in their judgment: AI is optimizing existing tactics such as social engineering, credential theft, and vulnerability exploitation rather than opening entirely new fronts, but the increase in attack speed and scale significantly compresses the defense window.

For the crypto industry, this trend is highly consistent with Coinbase-related incidents. The 2021 SMS vulnerability relied on phishing to obtain credentials, the 2025 insider bribery centered on social engineering to trick users into transferring funds, and the emails and phone numbers exposed in this Amplitude incident are precisely the raw material for phishing and social engineering. AI makes these attacks more personalized, multilingual, and harder to identify, while lowering costs and expanding the target range. Supply chain and third-party risks are also further amplified by AI-accelerated reconnaissance and exploitation.