The cryptocurrency exchange acknowledged the incident late Tuesday (Oct. 27) while denying reports that it had suffered a breach on its end.
“Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers,” the company’s support unit said in a post to social media platform X.
“We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted. We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.”
This incident follows a number of breaches involving crypto companies in the past few months. Findings released last month by CoinGecko showed that hacks and thefts had cost crypto platforms more than $3.6 billion in the previous 18 months.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
The research found that most of those incidents — resulting from cyberattacks and stolen passkeys — occurred even though the companies had performed security audits, though most of the attacks involved areas that checks do not typically cover.
“Audit reports often fail to capture the full spectrum of risk,” the CoinGecko report said. “Most exploits on audited systems target external infrastructure, unaudited code updates, or systemic features manipulated via governance attacks. Surprisingly, only about 11.0% of these incidents involved in-scope smart contract flaws, though these still resulted in $396.0 million in losses.”
Research by PYMNTS Intelligence, from the report “Vendors and Vulnerabilities: The Cyberattack Squeeze on Mid-Market Firms,” looked at the danger third-party vendor breaches pose to businesses, especially middle market companies.
In many cases, fraudsters employ social engineering tactics — impersonating a familiar vendor to trick an employee into paying a bogus invoice. Hackers also want to capture sensitive information or systems to engage in extortion in the form of blackmail or ransomware.
“Very often, hackers use social engineering to breach third-party vendors or suppliers as the first step in an attack,” the report said.
“By doing so, they can initiate malicious contact with target companies using the friendly front of a trusted partner, for example, by emailing urgent payment requests from a stolen email account. Compromised third parties can also open software or infrastructure backdoors into systems at an otherwise well-protected target company.”
The research found that 38% of fake invoice scams stemmed from compromised vendors or suppliers, while 43% of phishing incidents had their roots in third-party breaches.
Add as Preferred Source
