Coinbase Amplitude Data Leak: What It Means and How to Stay Safe

So, the recovery process consists of you setting up a new Coinbase Vault or Coinbase Wallet, which is the most secure cold wallet that Coinbase offers. And then we would go ahead and allow you to whitelist your address listed from that Coinbase cold wallet that you set up to go ahead and transfer your funds from that compromised Coinbase account into that new Coinbase wallet that you set up while our Coinbase investigators go ahead and see as what's going on in your account.

That's not Coinbase. That's a man reading a script, and the script was written off of a list. On the night of October 27, 2026, Coinbase said a new list got out. Not from Coinbase, from a company it hires to watch how you use the app. No passwords, no keys, no money, just who you are and how to reach you, which is everything that man on the phone needed.

If you've got a Coinbase account, you may get an email this week telling you your contact details were in it. Coinbase says your funds are safe, and that sentence is true. But the last time Coinbase said your funds were safe in May 2025, people still lost their retirement. Not through the exchange, through the phone. So, the question this video answers isn't did they get my money?

It's what does my name on a list turn into? And what do you do tonight so it turns into nothing? So, if you're feeling bullish, like this video and smash that subscribe button. We're on our way to 400,000 subscribers, and we can't get there without you. And if you're going to be the first millionaire in your family tree, confirm that by commenting 777 down below.

Also, I'm giving away our 2026 altcoin trading strategies and the crypto yield generation briefing to everyone who follows us on Instagram right now. Head over to Instagram, follow us at @bullrunnershq, @bullrunnershq. The official link is also down in the description if you can't find it. Let's run it. All right, Bull Runners, I'm Ryan Huggins, aka @winwithryan.

Welcome back to the channel. Here's what Coinbase actually said, word for word. Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data among other Amplitude customers. Amplitude, most of you have never heard of it.

Here's Amplitude describing itself.

Introducing Amplitude, the digital analytics [music] platform that's essential for every business. Out of billions of seemingly unrelated data points, Amplitude finds patterns and offers deep insights into your customers' experiences.

It's a company that watches what customers do inside an app. Where you tap, where you stop, how far you get before you give up. Coinbase's logo sits on its homepage next to Nvidia and Figma. To do that job, it has to know who you are. So, your name, your email, your phone number sit on Amplitude's computers, too.

Now, the number going around is 70,000 people. And I want to be straight with you about that number. It came from a post on X, not from Coinbase. Coinbase hasn't said how many. So, here's what we know for sure.

Contact details, a small subset. That same day, October 28th, the Binance founder counted four data leaks in one morning. Coinbase's vendor, a Korean exchange called Bithumb, two Korean brokerages, one of them with 38,490 customers, names, emails, home addresses, and account numbers out the door. Four in a day. And every one of them said the same thing.

The money is fine.

The practical danger from a leak like this is impersonation. Once an attacker has a list of real Coinbase users and a way to reach them, they can send messages that look like genuine security alerts, site accurate details to sound legitimate, and steer the target toward a fake login page or verify your account prompt that captures credentials. The breach does not have to touch funds to become the first step in a theft that does.

But I've heard the money is fine from Coinbase before, and I want to show you what it meant. On May 11th, 2025, the CEO of Coinbase got an email. "$20 or the data goes public."

It was a ransom note demanding $20 in Bitcoin in exchange for these attackers not releasing some information they claimed to have obtained on our customers. Now, we like to do things transparently here at Coinbase, and so I'm going to respond publicly to these attackers by saying, "No." We are not going to pay your ransom.

Here's how they got it. Nobody broke into a computer. Criminals found a customer support workers overseas, the people who answer the phone when you're locked out, and paid them cash to copy what was on their screens. Coinbase's own filing to the government lists what left the building. Name, address, phone, email, the last four of your social security number, part of your bank account number, photos of your driver's license, your balance, and your transaction history.

69,461 people. That's the number Coinbase gave the state of Maine on May 20th, 2025. And in the same filing, the same sentence you heard this week, "No passwords, no private keys, no customer funds were accessed." True, every word is true, but look at the dates. The filing says that stretch of copying started December 26th of 2024. Coinbase found out the full size of it in May 11th of 2025.

That's 4 and 1/2 months. And in those 4 and 1/2 months, the phones were already ringing. Before I show you who answered, you need to see one sentence Coinbase wrote about why the list was taken at all. This is Coinbase, May 15th, 2025, in its own blog post, word for word. "Their aim was to gather a customer list they could contact while pretending to be Coinbase, tricking people into handing over their crypto.

They then tried to extort Coinbase for $20 to cover this up. We said no. Their aim was a list, not the vault, the phone book.

The customer support agents do have access to personal information like name, date of birth, address, etc. The attackers still want access to this information because it allows them to conduct social engineering attacks where they can call our customers impersonating Coinbase customer support and try to trick them into sending their funds to the attacker.

That's the CEO explaining it himself. A name, a phone number, and the fact that you bank with Coinbase is not a leak. It's a script. And here's what the script cost. Coinbase's own shareholder letters, $307 million in the second quarter of 2025. $48 million more in the third. $355 million for a break-in where nobody broke in.

So, when Coinbase says no funds affected, it's telling the truth about the exchange. It is not telling you anything about your phone. The funds were never the target. You are. That's the whole check, honestly, for every place that holds your coins.

Who else holds your name? And what happens when they call? It's the walk-through that we do with people and our clients inside of SGS systems at Altcoin Pro. Account by account. And the links below, if you'd rather do it with somebody than alone.

Because this week's list is smaller than the last one, contact details, not bank numbers, not ID photos. But, a phone call doesn't need your ID photo. Here's who picked up last time. Glenn Fishman, Denver, November 2024.

You know, I knew in the back of my mind that Coinbase would never call the customer.

Yeah.

So, that's in the back of my mind. And he he was able to overcome that by telling me because of the volume of hacks that they were now instructed to reach out and try to help the customer.

He knew. He knew Coinbase doesn't call. And the man on the phone had an answer ready for that because the man on the phone had done this before.

So, over my Coinbase account, and I look in it, and everything's gone. Zero, zero, zero.

$176,000 gone. A big piece of retirement gone.

$176,000. The FBI later found 95,000 of it and told him it would take about a year to get it back. Ed Sumens, 67 years old, spent 20 years building art, including Jeff Koons' balloon dogs. In March 2025, he got a text that looked like Coinbase.

Then a call from a man calling himself Brett Miller from Coinbase security. And here's the part that should stop you. The caller told Ed his coins were in a hardware wallet. He was right. They were on a Trezor.

He knew that before he dialed. So, he walked Ed through a security procedure. Nine days later, a second caller finished the job. 17.5 Bitcoin and 225 Ether. Over $2 million.

Most of what he'd saved to retire on.

And you're probably thinking, "I'd never type my seed phrase into a website." Glenn thought that, too. Ed thought that. The difference between them and the people who hung up wasn't smarts. It was that the caller already knew things only Coinbase should know. So, that's only two people.

How many were there? Here's what the caller actually has when your name is on a list like that. Listen to how he opens.

We just got ahead and see that login from Salt Lake City, Utah, as well as this two-ticket request. Company minutes after you got logged in, which obviously raised some red flags um since we don't usually see that type of activity.

A login from Salt Lake City. Two tickets. A secondary email. He's not asking you anything. He's telling you things, and every one of them sounds like it came off of your account.

The investigator, Zach XBT, who tracks this money on the public ledger, counted at least $65 million taken from Coinbase customer this way in just 2 months, December 2024 and January 2025. His estimate for a year of it, more than $300 million. And he said his count runs low because most people never report. They're embarrassed. One man in Canada by Zach XBT's count in December of 2025 took over $2 million in a year posing as Coinbase support and spent it on rare usernames and bottle service.

And by the way, I get text messages all the time from Coinbase and other banks or other exchanges. And if you've never reached out to them, they should never reach out to you. One thing I also noticed that anytime any of this ever happens, what I do, especially if it's bank, right? I get bank people saying they're from the bank, I go to my debit card and call the number on that. So that way I know it's going directly to the actual bank account number.

Same thing with Coinbase. I always search for Coinbase's real phone number and call Coinbase myself if I need help. So that's what a list turned into last time. How far does a phone number get them? Further than you think.

It's called a SIM swap. The goal is to steal your phone number and infiltrate your online account.

That's a SIM swap. Somebody convinces your phone company they're you. Your number moved to their phone and every text code that protects your email, your bank, your exchange, now lands in their hand. Your phone number plus has a Coinbase account is the whole shopping list for that. And there's an older story that tells you where contact list listen up.

In the summer of 2020, a hardware wallet company called Ledger lost its customer list. 272,000 plus orders, names, emails, phone numbers, home addresses. In January 2021, after another 20,000 records leaked, customers started getting emails that opened with their own home address and demanded 0.3 Bitcoin, about $12,000 at the time, or they'd face physical violence. That list is still being used 5 years later. I told you on October 23rd what the end of that road looks like when the person with the list decides to skip the phone call and knock on the door.

And I'm not going to repeat it. Go watch that video. But that's the ceiling. The floor is a phone call, and the floor is where almost all the money goes. So, what did Coinbase tell you to do about it?

Turns out, they already wrote down. Same May 15th blog post, bottom of the page, here's the line. "We will never call or text you to give you a new seed phrase or wallet address to move your funds to. If you receive this call, hang up the phone." Now, go back to the man in the very beginning of the video. New vault, new wallet, move your funds.

He did the exact thing Coinbase says Coinbase never does. Every word of that call was the tell. That was May 2025.

For these would-be extortionists or anyone seeking to harm Coinbase customers, know that we will prosecute you and bring you to justice.

Coinbase's CEO announced one arrest, a former support agent in India, and said more were coming. As of October 28, 2026, that's still the count, one. So, the prosecuting is slow, the protecting is on you, and it's five things. You can grab a pen and paper and jot these down. Number one, turn off text message codes on Coinbase and put a hardware key or a passkey on it.

Coinbase's own video says security keys are the strongest thing they offer.

Turn on two-factor authentication everywhere you can. If you have YubiKeys or security keys available, that is the strongest [music] form of 2FA that you can use.

Number two, turn on withdrawal allow listing. That's a list of the only addresses your account is allowed to send to. A caller can't talk you into sending to a safe wallet if the account won't send there. Three, if you hold more than you trade, move it into a Coinbase vault with a time delay or off the exchange entirely. A vault won't release for 48 hours.

That's 48 hours for your head to clear. Four, the moment anything feels off, lock the account yourself inside the app. Then email security@coinbase.com. Coinbase's words, lock first, ask later. Number five, nobody from Coinbase ever calls you, ever.

If the phone rings and it's Coinbase security, you already have the answer. It's not that you're smart, it's that the company told you in writing. Nobody has said how many people are on this week's list. One more thing, Coinbase says it's emailing the people affected. In May 2025, those emails came from noreply@info .coinbase.com.

But, so will the fakes. An email about a leak is the best fishing bait there is. Don't click anything in it. Open the app yourself. Now, listen to the end of the call from the cold open.

Okay, so I know this isn't a real website. So, what's going on?

Excuse me, sir. It should just be your case number {dash} coinbase.com.

Yeah, but this definitely isn't a real Coinbase website when I'm looking at this.

That's how it's supposed to end. Not because he was clever, because he already decided, before the phone even rang, that Coinbase doesn't call. A list can't take your coins. It can only ask for them. Make the answer no before the phone rings.

Did you get the email this week? Just a simple yes or no in the comment section. Everything in this video came from Coinbase's own filing, its own blog post, and people who said on camera what the call cost them. It's public, and almost nobody reads it until their phone rings. Knowing who holds your coins, who holds your name, and what happens when somebody calls is the job.

That's what SGS system inside of Altcoin Pro does with our clients, account by account. If you're holding $50,000 or more, and nobody's ever sat down with you and mapped out where it all lives, and who can reach you about it, gone through all the security issues, how to solve them, that's who this is for. If you're not there yet, keep watching these videos. They're free, and we're not going to stop making them. If this money is money that you and your spouse decide on together, bring them onto that call with you, because the call might come to their phone, not yours.

The first link in the description gets you started. Book a call with us immediately. Crypto carries risk and past performance doesn't guarantee future results. This is education, not financial advice. You know what to do.

Stay bullish. I'll see you at the top.