Coinbase Seed Phrase Tool Sparks Phishing Concerns

Blockchain security experts have raised urgent alarms over a Coinbase Commerce webpage that prompts users to enter their cryptocurrency wallet recovery phrases, or seed phrases, directly into a plain-text form, potentially exposing users to phishing risks as the service prepares to shut down next year.

The issue surfaced this week when researchers identified the page at withdraw.commerce.coinbase.com/seedphrase, which instructs users to paste their 12-word mnemonic phrases to recover funds from self-custodial wallets. The tool was referenced in Coinbase Commerce help documentation, guiding merchants to import phrases into compatible wallets like Coinbase Wallet or MetaMask during the asset withdrawal process. Discovery of the page intensified on Thursday, drawing criticism from prominent figures in the blockchain security community.

Yu Xian, founder of security firm SlowMist, described the practice as an "unbelievable lack of security awareness from a major industry player" after receiving multiple user reports. On-chain investigator ZachXBT echoed the concerns, warning on social media that the page creates a "direct attack surface for social engineering campaigns targeting...