Security researchers are warning users about a Coinbase Commerce recovery page that requests 12-word seed phrases for fund withdrawals. Security firm SlowMist and investigator ZachXBT labeled the practice extremely unsafe and baffling. They warn this method increases the risk of phishing attacks and wallet drains.
Coinbase is currently phasing out its Coinbase Commerce service. The company set a March 31, 2026, deadline for users to migrate to Coinbase Business. The controversial recovery page serves as one method for users to reclaim funds during this transition.
Experts fear the deadline may pressure merchants into using insecure recovery methods. Scammers could also replicate the official page to steal assets from users rushing to meet the cutoff.