Coinbase Commerce is facing criticism over a withdrawal recovery flow that reportedly asks users to enter a plain-text seed phrase into a web form during asset migration. The issue quickly drew attention because a seed phrase is the highest-level credential for a crypto wallet. Once exposed, control of the wallet can be lost outright.
Security researchers reacted sharply. Cos described the behavior as “extremely unsafe”, questioning why a merchant-facing page would request such sensitive wallet data. Independent investigator ZachXBT said the structure of the flow could be copied by malicious actors, allowing fake pages to imitate the official interface and making social engineering attacks far easier to execute.
The concern centers on interface design, not malware in Coinbase’s core system
Reports do not suggest that Coinbase’s core systems contain malware or an inherent platform compromise. The main concern is different: a design that normalizes seed phrase entry on a website can expand the phishing surface. If users come to believe that an official page may legitimately request a recovery phrase, copycat sites gain a much stronger lure.
According to accounts shared in news coverage and on social platforms, the withdrawal page displays instructions telling users to sign in to Google Drive from the portal, copy the phrase, and paste it into a text field. The step is said to help merchants recover legacy self-custodial wallets. That is exactly what alarmed security observers, because moving a seed phrase out of storage and into an online form runs against basic wallet protection practices.
Migration to Coinbase Business is part of the backdrop
The recovery process is tied to Coinbase’s plan to move Commerce into Coinbase Business by March 31, 2026. The transition may be intended to simplify migration, but critics say the goal does not justify asking users to submit the most sensitive credential tied to wallet ownership. A recovery method can still be unsafe even if it is presented inside an official migration path.
Security specialists stressed a simple rule: a recovery phrase should not be entered into any website. The risk is not theoretical. If a seed phrase is exposed through a phishing page, an incorrect form, or insecure digital storage such as screenshots and online documents, the wallet’s assets can be drained with no practical way to reverse the transfer on-chain.
Researchers say imitation pages and user error are the biggest threats
This matters because the seed phrase functions as the master key to the wallet. A single mistake is enough. Researchers warned that human error remains one of the biggest sources of crypto losses, and a web flow that asks users to paste recovery words can increase that danger by making unsafe behavior look routine.
Public guidance around the issue is consistent: do not type a seed phrase into a website, do not share private keys through chat or forms, and avoid keeping recovery words in screenshots, cloud documents, or other internet-connected storage. If there is confusion about an asset transfer or migration step, users should verify it through official Coinbase support rather than relying on links delivered through messages or email.