Coinbase Data Breach (Oct 2026): What It Means for Coinbase One Card Holders

By the CryptoCashbackCard Editorial Team. Facts checked October 30, 2026. Last updated October 30, 2026.

Short answer

If you searched coinbase data breach this week, here is what actually happened: Coinbase says it has not had a data breach. An analytics vendor Coinbase uses, Amplitude, had a security incident that exposed contact and limited transaction data for what Coinbase calls a “small subset” of its customers. Coinbase says it found no evidence of unauthorized access to its own systems and that customer funds were not affected (Decrypt; Unchained).

• Not exposed, per Coinbase: home addresses, passwords, or “any other information that would allow someone to directly access your account or your funds.”
• Not disclosed: how many Coinbase customers were affected or exactly which contact fields leaked. We don’t guess.
• Real risk for cardholders: phishing and fake “fraud department” calls that use leaked contact details — not stolen card numbers.
• Coinbase One Card protection: under the cardholder agreement, your liability for unauthorized use is capped at $50, and you aren’t liable for use after you report it.

What happened: timeline (Central Time)

Coinbase had not filed an SEC Form 8-K about this incident as of October 30, 2026 (we checked Coinbase’s EDGAR filing list; the most recent 8-K, filed October 29, covers quarterly results).

Coinbase data breach vs. vendor incident: what was exposed — and what wasn’t

Why the wording matters: a breach of Coinbase’s own systems and a leak at a third-party vendor are different events, and Coinbase has been explicit that this was the latter. For you, the practical effect is similar to any contact-data leak — your email or phone number may now be on a scammer’s list.

Is this the same as the May 2025 Coinbase breach?

No. Many top results for “Coinbase data breach” still describe the May 2025 incident, which was a different event with a different cause. In a Form 8-K filed May 15, 2025, Coinbase said criminals paid contractors or employees in support roles outside the U.S. to obtain customer data, including names, addresses, phone numbers, emails, the last four digits of Social Security numbers, masked bank numbers, government-ID images, and balance and transaction data. It said no passwords or private keys were taken, that it would not pay the extortion demand, and it estimated costs of roughly $180 million to $400 million.

A later notice filed with the Maine Attorney General put that 2025 incident at 69,461 affected customers, as reported by TechCrunch and SecurityWeek. A Coinbase spokesperson said they believed the viral “70,000” claim this week mixed up the new vendor incident with that 2025 figure (Unchained).

What the Coinbase data breach reports mean for Coinbase One Card holders

The Coinbase One Card is issued by First Electronic Bank under a license from American Express, and serviced by Cardless. Coinbase is not a party to the cardholder agreement (Cardholder Agreement). Three things follow:

1. Card data lives with the issuer and servicer. Nothing Coinbase or the press has published says card numbers, CVVs, or expiration dates were part of the Amplitude exposure.
2. Your fraud liability is capped at $50. The agreement says you won’t be liable for unauthorized use after you notify the issuer, and “in any case, your liability will not exceed $50.” That is a cap, not a “$0 / zero liability” promise, so report quickly. Federal rules set the same $50 ceiling for credit cards (CFPB).
3. Your rewards sit in your Coinbase account. Bitcoin rewards are credited to your Coinbase account (rewards terms), and card-network fraud protections don’t cover crypto someone tricks you into sending away. That makes account takeover through phishing the risk worth guarding against.

For how fraud holds and declines already work on this card, see our Coinbase One Card gotchas.

Phishing tells to watch for

Leaked contact data is mostly useful to scammers who want to sound legitimate. Expect messages that reference this news. Red flags:

• A call or text saying your account or card is “compromised” and you must move funds to a safe wallet. Coinbase says its agents will never “ask you to secure, move, or access your funds” (Coinbase tech support scams page).
• Requests for your password, 2FA code, or recovery phrase, or to install software or remotely access your device — Coinbase lists all of these as things its agents will never do.
• A fake “Coinbase One Card fraud department” call. Hang up and call the number on the back of your card or in the app.
• Emails with links to “verify” your account after the incident. Open the Coinbase app directly instead.
• A request to call an unfamiliar number. Coinbase “will never ask you to contact an unknown number to reach us.”
• Pressure and urgency (“act in 30 minutes or lose access”).

6 steps to take now

Whether or not you got a notice, these steps cost nothing and blunt the follow-on scams that usually trail any Coinbase data breach headline.

1. Upgrade 2-step verification on Coinbase to a passkey or hardware security key instead of SMS.
2. Check the Coinbase app directly for any notice — don’t trust links in emails or texts.
3. Lock first, ask later. Coinbase’s advice: “If something feels off, lock your account in-app and email security@coinbase.com.” Coinbase’s help pages don’t document a separate card-lock switch, so for card fraud go straight to step 4.
4. Report unauthorized charges fast to First Electronic Bank c/o Cardless at (855) 508-5066 or resolutions@cardless.com, per the cardholder agreement. Fast reporting is what keeps you at or below the $50 cap.
5. Review statements and Coinbase activity for charges or withdrawals you don’t recognize, and turn on alerts.
6. If you think someone got into your Coinbase account, lock it and report through Coinbase’s official fraud and suspicious activity help pages.

Does this change whether you should get the card?

Not on its own. Based on what Coinbase has disclosed, this was a contact-data leak at a vendor, not a failure of card security or a loss of funds. The card’s fraud terms ($50 cap, billing-error dispute rights in the agreement) are unchanged. What it does reinforce: rewards that accrue inside an exchange account need the same protection as any crypto you hold there. If you’re comparing options, our best crypto cashback cards page lays out issuers and terms side by side, and our Coinbase taxes guide covers how card rewards are treated at tax time.

For the bigger picture on card fraud protection versus exchange risk across Coinbase, Gemini, Robinhood and Krak, see our guide: Are crypto credit cards safe?

For context only: on October 29, Binance.com reported a separate, unrelated multi-billion-dollar security incident; Binance.US said it was not affected. It has no connection to the Amplitude vendor incident.

FAQ

Was there a Coinbase data breach in October 2026?

Coinbase says no: it “has not had a data breach” and found no evidence of unauthorized access to its systems. The exposure happened at its analytics vendor, Amplitude.

Was my Coinbase One Card number exposed?

Neither Coinbase nor the reporting we reviewed says card numbers were involved. Coinbase described the data as contact and limited transaction data.

Is the “70,000 users” claim true?

A Coinbase spokesperson called it “false.” Coinbase has not given its own count, so we don’t publish one.

How do I know if I was affected?

Coinbase says it is notifying impacted customers and regulators as legally required. Check the app and your registered email, and be wary of lookalike messages.

Will I be reimbursed for fraudulent card charges?

Under the cardholder agreement your liability for unauthorized card use won’t exceed $50, and nothing after you report it. That covers card charges; it doesn’t cover crypto you’re tricked into sending yourself.

Did Coinbase tell customers to do anything specific?

As of Unchained’s October 28 report, Coinbase had not issued incident-specific steps. The steps above follow its standing anti-scam guidance and the card agreement.

Sources

Official (checked October 30, 2026):

• Coinbase One Card Cardholder Agreement (First Electronic Bank / Cardless): https://legal.cardless.com/cardholder_agreement/coinbase/cardholder_agreement.pdf
• Coinbase One Card rewards terms: https://www.coinbase.com/legal/creditcard/rewards
• Coinbase Help, payment failure: https://help.coinbase.com/en/creditcard/payment-failure
• Coinbase Form 8-K, May 15, 2025: SEC EDGAR
• CFPB, unauthorized credit card charges: consumerfinance.gov

Press (Coinbase and Amplitude statements as quoted):

• Decrypt · Unchained · Cointelegraph · CoinDesk · TokenPost
• May 2025 Maine AG figure: TechCrunch · SecurityWeek

Disclaimer

CryptoCashbackCard is an independent site. We are not affiliated with, sponsored by, or endorsed by Coinbase, First Electronic Bank, Cardless, American Express, or Amplitude. Marks belong to their owners and are used only to identify products. This page contains no affiliate or referral links and is general information, not financial, legal, or security advice. This is a developing story; details may change after the date above. Always check the Coinbase app, your cardholder agreement, and official notices.