Coinbase Faces Security Criticism Over Seed Phrase Requests from Users

Coinbase, the world's largest cryptocurrency exchange, is facing growing criticism for requiring users to input their seed phrases during the migration of Coinbase Commerce to Coinbase Business. This practice has raised significant security concerns, as experts warn that legitimate services should never ask users to enter their seed phrases online.

Security researchers have highlighted that the move undermines established cryptocurrency security protocols. Seed phrases, also known as recovery phrases, are the cryptographic keys to digital wallets and should never be shared with anyone. Asking users to input these phrases on a web form—even on an official page— can expose them to social engineering attacks and phishing scams.

The controversy centers around Coinbase's 'withdraw.commerce.coinbase.com/seed-phrase' page, where users are asked to enter their 12-word mnemonic phrases for asset recovery. This process is part of the company's broader plan to consolidate its platforms under Coinbase Business by March 31, 2026.

Why Did This Happen?

Coinbase launched a new merchant recovery tool to assist users in transferring funds during the migration. However, the tool requires users to type their seed phrases directly into the page, a step that cybersecurity experts have called 'extremely unsafe'.

The page was flagged as a potential attack vector, as threat actors could replicate it or create fake versions to steal sensitive information. SlowMist founder Cos and blockchain investigator ZachXBT both raised concerns, noting the risk of users being manipulated into exposing their seed phrases according to reports.

Experts emphasize that proper security protocols should never involve users sharing their seed phrases with online services. Instead, best practices include using hardware wallets or controlled recovery processes that keep seed phrases offline.

How Did Markets Respond?

The controversy comes amid a period of growing trust in Coinbase's financial performance. Despite a Q4 GAAP loss, the company reported strong subscription and services revenue and growing custodial assets. However, security missteps can quickly erode confidence, particularly in a space where trust is paramount.

Investors and users are now watching to see how the company addresses the issue. The migration deadline of March 31, 2026, is fast approaching, and any prolonged issues with the process could affect user satisfaction and regulatory scrutiny.

Coinbase has yet to publicly respond to the criticisms, though it has offered alternative withdrawal methods. These include using a commerce withdrawal tool, which is considered the safer option, or importing seed phrases into third-party wallets like MetaMask.

What Are Analysts Watching Next?

Security analysts are monitoring whether Coinbase will revise the tool or remove the feature that requests seed phrases directly. The broader crypto community is also watching for any signs of increased phishing attempts or scams targeting Coinbase users.

Regulators may also take notice, particularly as the U.S. government intensifies its focus on cryptocurrency security and compliance. The company's response could set a precedent for how major exchanges handle user security in the future.

For now, Coinbase users are advised to use the recommended withdrawal methods and to avoid entering their seed phrases on online forms. As the migration deadline nears, the pressure on Coinbase to address the security concerns will only grow.