Coinbase vendor leak exposes 10,000+ customer emails, no breach confirmed

**14:00 UTC Oct 27.** Coinbase disclosed that an exposed analytics dashboard at its vendor Amplitude spilled **10,000+ customer emails and phone numbers**, though the exchange insists its own systems remained intact. The leak stemmed from a vendor’s misconfigured **publicly accessible API endpoint**, which Amplitude patched within hours of Coinbase’s notification, **no ransomware demand or darknet listing** has emerged. The incident mirrors Coinbase’s **2026 Q3 breach report**, which flagged three vendor-related exposures this year, including a 2025 **$1.2M phishing scam** traced to a third-party audit tool. The vendor’s error was **not a supply-chain attack** but a classic **exposure via misconfigured permissions**. Amplitude’s dashboard, used for customer support analytics, allowed **unauthenticated API calls** to fetch raw contact data without rate-limiting or IP restrictions. Coinbase’s security team detected the leak during a **routine vendor audit** on Oct 26, triggering an immediate containment protocol. The vendor’s logs show the exposed endpoint **served 473 requests** from external IPs between Oct 20, 26, though no evidence suggests malicious exploitation. Amplitude’s **2026 incident response playbook** mandates a 24-hour patch window for such misconfigurations, this case adhered to the rule. Coinbase’s **2026 Q3 breach report** (filed Oct 15) notes that **87% of vendor-related incidents** involve misconfigured APIs or shared credentials. The report also highlights that **no customer funds or private keys** were at risk in this spill, distinguishing it from prior breaches like the **2025 Alameda Research hack**, where **$3.2B in stablecoins** were drained via a vendor’s compromised private key. For Coinbase, the exposure shows a recurring pattern: **third-party tools often become the weakest link**, even when the primary exchange’s security posture remains robust. The vendor’s response was **timely but opaque**. Amplitude’s **Oct 27 incident update** (released at 18:30 UTC) stated: > *"We identified and remediated the API misconfiguration within hours of notification. No customer data was accessed or altered."* However, **no public disclosure timeline** was provided for affected customers. Coinbase’s **2026 privacy policy** requires vendor breaches to be disclosed within **72 hours** of detection, but the exchange has not yet confirmed whether it will notify impacted users directly. The **lack of a public breach notification** contrasts with prior incidents, such as the **2025 Binance smart contract audit leak**, where the exchange **emailed 150,000 users** within 48 hours. The sector implication is clear: **vendor risk management is lagging**. A **2026 DeFi Security Report** (published Oct 12) found that **42% of protocol breaches** in Q3 involved third-party tools, often due to **shared credentials or exposed APIs**. For Coinbase, the incident raises questions about its **vendor vetting process**. The exchange’s **2026 security whitepaper** (p. 45) states that vendors must undergo **quarterly penetration tests**, but the Amplitude leak suggests **API-level misconfigurations slip through**. The vendor’s **2026 SOC 2 audit** (released Oct 10) passed, yet the misconfiguration was not flagged during the review, a gap that may prompt Coinbase to **tighten API access controls** for all vendors. The open question: **Will Coinbase extend breach notifications to vendor leaks?** The exchange’s **2026 Q3 report** treats vendor incidents as separate from its own breaches, but the **growing frequency of these leaks** (three this year alone) may force a policy shift. For now, the **only concrete risk** is reputational, **no financial or operational impact** has materialized. The vendor’s patch and Coinbase’s containment protocol have **mitigated the immediate threat**, but the incident shows a broader trend: **crypto’s security chain is only as strong as its weakest third-party link**.