Coinbase Commerce prompts seed phrase uproar amid security fears

- Coinbase Commerce subdomain asked users for seed phrases. - Experts warn the flow risks phishing and poor security practices. On March 19, 2026, Bloomberg and CoinDesk reported that a Coinbase Commerce subdomain hosted a withdrawal page requesting users' seed phrases. The request sparked sharp criticism, as the practice violates established cryptocurrency security principles by encouraging users to share their seed phrases, an action that grants complete access to a crypto wallet and its funds. The page, to which a now-removed Coinbase Help guide directed users attempting to withdraw funds, was part of the wind-down of Coinbase's Commerce product, scheduled to sunset on March 31, 2026. Consequently, blockchain security experts and investigators expressed alarm over the risks this process posed. In response, Yu Xian, founder of blockchain security firm SlowMist, described the incident as an "unsafe practice" from a platform of Coinbase's stature, while blockchain investigator ZachXBT flagged concerns that threat actors could exploit the withdrawal page for phishing and social engineering attacks. Both experts stressed that asking users to input their seed phrases undermines fundamental self-custodial wallet security and exposes users to fraud. At the time of writing, Coinbase had not issued an official statement addressing the matter, leaving questions about whether the issue stemmed from a technical error or from shortcomings in managing the shutdown of Coinbase Commerce. The company’s subsequent removal of the help guide and related documents further deepened the uncertainty surrounding the process. The incident has heightened worries among users and security professionals about the normalization of unsafe practices, underscoring the dangers of exposing seed phrases in any context. As the March 31 withdrawal deadline nears, Coinbase continues to face scrutiny over its response to these security concerns.