In a surprising development that has sent shockwaves through the crypto community, security experts have flagged a Coinbase Commerce page for serious security concerns. The official withdraw page reportedly asks users to type their 12 word mnemonic phrase, also known as seed phrase or recovery phrase, directly in plain text. Experts are calling this extremely dangerous and potentially exploitable by hackers.
The issue first gained attention after blockchain investigator ZachXBT posted a warning on X, formerly Twitter. He shared a screenshot of the page and questioned whether Coinbase had an official page that threat actors could use to target users through seed phrase social engineering. This comes alongside alerts from SlowMist, a well known blockchain security firm. Its founder, known as Evilcos, said he was very puzzled why Coinbase would have such a page that directly asks users to enter their mnemonic phrase in plain text to recover assets. He described the practice as unsafe and unbelievable, even suspecting the subdomain might have been hacked.
What exactly is happening on the Coinbase Commerce page
According to reports and screenshots circulating online, when users try to withdraw funds or recover assets through Coinbase Commerce, the interface prompts them to enter their full mnemonic phrase. This phrase usually contains 12 or 24 secret words that control the entire wallet. The page even suggests copying the phrase from Google Drive and pasting it directly. Everything is entered in plain text and not hidden or encrypted. Reports claim this is not a fake or third party site but an official Coinbase subdomain.
Why this is extremely dangerous explained simply
A mnemonic phrase (seed phrase) is like the master key to your crypto wallet. Think of it this way:
- Your bank account has a password.
- Your crypto wallet has this one single set of 12-24 words.
- If anyone gets these words, they can access all your funds instantly including Bitcoin, Ethereum, USDT and everything else, and transfer them away forever. There is no password reset and no recovery possible.
Crypto security rule #1 that every expert repeats
Never type your seed phrase online. Never share it. Never paste it anywhere except on your own offline device.
By asking users to enter it in plaintext on a web page (and even suggesting Google Drive), the page breaks this golden rule. Hackers or scammers can:
- Use social engineering tricks (fake messages, urgent calls, fake support) to send users to this page.
- Steal the phrase the moment it’s typed.
- Drain wallets in seconds.
ZachXBT specifically warned that this setup gives “threat actors” an easy tool to target Coinbase users.
Coinbase response so far: As of March 19, 2026, Coinbase has not issued any official statement, fix, or clarification. Their main account and support channels have not posted any updates. There has been no blog post or security advisory released yet.
What users should do immediately
Security experts and the crypto community are giving one clear message:
- Never enter your seed phrase on any website, app, or page even if it looks official
- If you see any page asking for it, close it immediately and report it
- Always use hardware wallets like Ledger or Trezor for large amounts since they never expose the seed online
- If you already entered your phrase anywhere suspicious, move your funds to a new wallet immediately
- Double check every URL before typing anything sensitive
This incident is a strong reminder: In crypto, you are your own bank. One wrong click or paste can cost everything.This comes amid growing security concerns across the crypto space. A recent Bitrefill incident exposed around 18,500 customer records, highlighting how even established platforms are not immune to cyberattacks.
