Why Third Parties Again? A Review of Coinbase's Supply Chain Risks and Defense Dilemmas

Written by: Nicky, Foresight News

On October 28, according to DelCrxpto and SlowMist's Chief Information Security Officer 23pds, Coinbase experienced a data breach where hackers obtained contact information for over 70,000 users, but it has not yet been confirmed whether passwords or funds were stolen.

On the same day, Coinbase responded, stating that "there has been no data breach." According to their statement, the analytics service provider Amplitude encountered a security incident that affected some Coinbase customer contact data as well as data from other Amplitude customers. The team found no evidence of unauthorized access to Coinbase's systems, and customer funds were not affected. The company will notify affected customers and regulatory agencies in accordance with legal obligations.

As of the time of writing, Amplitude has not responded to this incident.

Who is Amplitude?

Amplitude is a publicly traded American company that provides a digital product analytics platform, headquartered in San Francisco, with the stock code Nasdaq: AMPL. Its business helps companies analyze user behavior on the web and in apps, with features including real-time insights, session replay, A/B testing, and data activation, using a SaaS subscription model.

The company originated in 2011 when Spenser Skates and Curtis Liu founded Sonalight, initially creating a voice-to-text messaging application, and entered Y Combinator in the winter of 2012. Due to a lack of effective user behavior analysis tools, the two built an internal analytics system, and then officially shifted to product analytics in 2014, launching under the Amplitude brand.

The third co-founder, Jeffrey Wang, joined in the same year, and his previous work experience at Palantir and Sumo Logic helped the company establish large-scale data processing capabilities. Skates is currently the CEO, holding a bachelor's degree in bioengineering from MIT, and has won the MIT Battlecode programming competition twice.

Amplitude went public directly on Nasdaq in September 2021, with projected revenue of approximately $343 million for fiscal year 2025, employing around 750 to 800 people, and serving clients ranging from startups to Fortune 100 companies. Notably, AMPL's stock price began to rise from $6.60 in late June, reaching a new annual high of $17.72 on October 23.

Regarding this incident, as of October 28, there has been no official statement or status page announcement from Amplitude. The company has not previously had any public records of large-scale data breaches on its platform. In the SpotAngels incident in September 2026, a third party accessed some data stored on Amplitude using stolen credentials, but SpotAngels clarified that the Amplitude platform was not breached.

Amplitude has clear client cases in the finance and cryptocurrency sectors. Ramp Network is a cryptocurrency deposit and withdrawal platform that extensively uses Amplitude's analytics, experimentation, and session replay features primarily for product analysis and user journey insights, rather than for core fund systems. Xapo Bank is a Bitcoin bank and custody institution that uses Amplitude Analytics and Feature Experimentation to optimize account opening processes, also not involving core custody and private key systems.

Other financial clients include the American fintech company Dave, Salt Bank, and some forex and derivatives brokers. For these clients, the risks are mainly limited to behavioral analysis data and some contact information, rather than transactions, balances, or private keys. The main threats after a data leak are phishing, social engineering, and SIM swapping, rather than direct theft of cryptocurrency.

Coinbase stated that the incident affected data from other Amplitude customers, but currently has not publicly named any specific companies. Ramp Network, Xapo, and others have also not released related statements. Affected parties may choose to privately notify users or are still assessing the scope of the impact.

Coinbase Has Previously Experienced More Severe Security Incidents

This is not the first time Coinbase has faced data and account security issues.

The most severe incident occurred in 2025. According to official disclosures, criminals bribed overseas customer service agents to copy data from the customer support system, affecting approximately 69,461 users. The leaked content included names, addresses, phone numbers, emails, the last four digits of social security numbers, masked bank information, images of government identification documents, account balance snapshots, and transaction histories, but did not involve passwords or private keys. Attackers primarily used this information to impersonate Coinbase employees and trick users into transferring cryptocurrency.

Coinbase refused to pay a ransom of $20 million, instead setting up a reward of the same amount for capturing and convicting the perpetrators, while also firing related personnel, cutting ties with outsourced customer service providers, and voluntarily compensating retail users who were tricked into transferring funds due to the incident. The company's Q2 2025 financial report confirmed related costs of approximately $307 million, including customer compensation and direct legal costs.

An earlier incident occurred between March and May 2021. Attackers obtained email addresses, passwords, and phone numbers through phishing, exploiting a vulnerability in Coinbase's SMS account recovery process to bypass two-factor authentication, resulting in at least 6,000 accounts having funds transferred out. Coinbase subsequently fixed the vulnerability and fully compensated the stolen funds at their value at the time of the incident.

The commonality between the two incidents is that the direct losses were ultimately borne by the platform, but once data leaks occur, the subsequent risks of phishing and social engineering persist over the long term.

On October 28, Binance founder Zhao Changpeng (CZ) posted on X platform that four data breach incidents were reported that day, involving not only Coinbase's third-party service provider Amplitude but also the South Korean cryptocurrency exchange Bithumb, as well as traditional financial institutions Mirae Asset and Daishin Securities in South Korea.

CZ pointed out that information leaked from trading platforms, including names, emails, phone numbers, addresses, identification documents, and transaction records, could be used for phishing, SIM card hijacking, and social engineering attacks. His suggestions focused on account isolation and verification methods: setting up separate emails and strong passwords for different trading platforms, prioritizing the use of hardware security keys, Passkeys, or authenticators, avoiding reliance on SMS two-factor authentication, and enabling withdrawal address whitelists and anti-phishing codes. Additionally, users should regularly check account login sessions and API key permissions, and be vigilant against scams impersonating customer service.

He also warned that leaked address and asset holding information could lead to real-world extortion or robbery risks, urging users to avoid disclosing personal asset situations.

Moreover, several institutions have observed that the rapid development of AI is closely related to the recent surge in security incidents, with its main role not being to create entirely new attack types but to significantly lower the barriers to attacks and accelerate the scaling of existing methods.

Research conducted by Harvard Kennedy School in collaboration with Bruce Schneier shows that fully automated personalized spear phishing by large models has a click-through rate of about 54%, comparable to human experts, and far exceeds the approximately 12% of ordinary phishing, potentially increasing profits from large-scale activities by up to 50 times. Microsoft's report also provided similar click-through rate data. Deepfake voice and video further amplify these risks.

The pace of exploiting vulnerabilities is also accelerating. Microsoft's report states that the median time from vulnerability disclosure to weaponization is often less than 24 hours. CrowdStrike's 2026 Global Threat Report indicates that AI-enabled adversarial activity grew by 89% in 2025, with the "breakthrough time" for cybercrime from initial access to lateral movement reduced to an average of 29 minutes. IBM's "Cost of Data Breach Report 2026" notes that about a quarter of malicious breaches are AI-related, with an average cost that is higher.

Bruce Schneier emphasizes the dual-use of AI: it can efficiently automate phishing while also being used for high-accuracy identification of phishing intentions. He believes that in the short term, defenders may benefit more in certain aspects, but this is an ongoing arms race. Institutions like CrowdStrike, Microsoft, and IBM agree that AI is optimizing existing tactics such as social engineering, credential theft, and vulnerability exploitation, rather than opening new fronts, but the increase in attack speed and scale significantly compresses the defense window.

For the cryptocurrency industry, this trend closely aligns with the incidents related to Coinbase. The SMS vulnerability in 2021 relied on phishing to obtain credentials, the insider bribery in 2025 was fundamentally a social engineering scheme to trick transfers, and the email and phone numbers exposed in the Amplitude incident are precisely the raw materials for phishing and social engineering. AI makes these attacks more personalized, multilingual, and harder to detect, while also lowering costs and expanding target ranges. Supply chain and third-party risks are further amplified due to AI-accelerated reconnaissance and exploitation.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.