I don't see the conflict with those statement. They're saying "we don't know where the information came from and we haven't found any evidence that it came from

I don't see the conflict with those statement. They're saying "we don't know where the information came from and we haven't found any evidence that it came from Coinbase itself". It's difficult to prove a negative here until you find where the stolen credentials originated from. They're just saying that they have no evidence that it came from themselves thus far.