A Coinbase subdomain linked to its Commerce tool reportedly directed users to a withdrawal page asking to enter their seed phrases, raising concerns among security observers.
Security researchers have raised concerns about a Coinbase-associated Commerce page that appeared to prompt users to enter wallet recovery phrases, warning that such a flow could normalize behavior commonly exploited in phishing scams.
The page has circulated widely on social media after being flagged by the founder of the blockchain security platform SlowMist, Yu Xian, widely known as Cos.
“I’m really puzzled why Coinbase would have a page like this, directly asking users to input their plaintext mnemonic phrases for asset recovery,” Yu wrote in an X post on Wednesday, adding: “Such an insecure practice is simply unbelievable.”
