Security researchers are sounding alarms over a Coinbase Commerce page that appeared to prompt users to enter wallet recovery phrases. The episode has reignited concerns that a flow leveraging seed phrases could normalize behavior routinely exploited in phishing attempts, especially when associated with a trusted platform.

The contention began after Yu Xian, the founder of blockchain security firm SlowMist and a prominent figure in security circles, drew attention to the page on X. He questioned why a Coinbase-hosted page would solicit plaintext mnemonic phrases for asset recovery, describing the practice as an unconscionable security lapse.

Coinbase has not publicly explained the page’s origin, beyond saying it is reviewing the matter. The company told Cointelegraph it is looking into the issue but did not offer further information at publication. Yu Xian did not respond by press time, and Cointelegraph has not received a comment from him since initial outreach.

In the crypto community, seed phrases are considered the keys to a self-custody wallet. Users who share them risk handing control to attackers, as the phrases grant full access to assets stored in compatible wallets. The guidance remains stark: never disclose seed phrases to third parties, customer support, or untrusted websites.

Coinbase referenced the subdomain as a commerce “withdrawal tool”

Members of the crypto sleuthing community, including ZachXBT, highlighted that the page was referenced in Coinbase’s public Help documentation surrounding its Commerce product. ZachXBT noted that the guide appeared to describe a method for users to recover funds by importing seed phrases into compatible wallets such as Coinbase Wallet or MetaMask, pointing to a withdrawal tool hosted on the same subdomain that has drawn scrutiny.

The narrative was reinforced by statements in Coinbase’s own Help materials, which describe self-custodial wallets—meaning Coinbase does not have access to seed phrases and cannot recover funds if they are lost. The documentation has since sparked questions about how such guidance aligns with the observed page prompting seed phrase input.

“So basically Coinbase has an official page live threat actors can use to target Coinbase users via seed phrase social engineering if they wanted?”

That line, shared by ZachXBT on X, underscores the potential for a phishing vector that leverages a perceived official pathway to seed Phrase recovery, should the page prove legitimate or be misconfigured. The incident sits at the intersection of user education, platform trust, and the evolving complexity of self-custody workflows.

Why this matters for users and builders

Seed phrases are the linchpin of self-custody security. A page that casually requests such credentials, even within an official-sounding context, runs counter to best practices widely taught by wallet providers and security researchers. For users, it raises the stakes of social engineering campaigns that blend legitimate branding with deceptive prompts. For developers and exchanges, the episode highlights a delicate balance: offering recovery and interoperability features without exposing users to new attack surfaces.

Self-custodial wallets give users direct control over private keys and recovery phrases, but with that control comes responsibility. If a trusted portal inadvertently or inadvertently appears to solicit mnemonic data, users may be tempted to comply, especially during times of asset risk or loss. The incident thus taps into broader debates about how to design recovery flows that are both user-friendly and resistant to manipulation.

Coinbase’s response and the path forward

Coinbase has acknowledged the matter and said it is investigating, though details have not been provided publicly. The company has previously advised users against pasting seed phrases into any website and has emphasized that its Commerce wallets are self-custodial, meaning Coinbase cannot access seed phrases or recover funds if they are lost. The current episode raises questions about whether the page represented an official feature, a misconfiguration, or a security gap in the documentation surrounding Commerce.

Separately, Coinbase has been vocal about warning signs of phishing and social engineering, noting that scammers may impersonate customer support over the phone or online to harvest login details and verification codes. The firm has urged users to stick to official channels on X and Reddit for support. The evolving situation leaves several uncertainties:

• Was the page a technical error, a misconfigured subdomain, or an actual attempt to steer users toward seed-phrase recovery?
• Did the referenced help guide reflect current product flows, or has it been altered or removed in response to the scrutiny?
• What steps will Coinbase take to prevent similar prompts in the future, and will there be updates to Commerce documentation to clarify best practices around seed phrases?

Context from the wider security landscape

Phishing and social engineering remain pervasive risks in crypto, with attackers continually adapting their lures around familiar brands and services. The OpenClaw phishing episode, for instance, illustrated how attackers mix messaging around “free tokens” with authentic-looking interfaces to entice victims. In that climate, any ecosystem feature that touches seed phrases—whether as part of a recovery workflow or a cross-wallet import—demands especially rigorous safeguards and clear user education. Cointelegraph previously covered how security researchers urge vigilance against seed-phrase exposure, underscoring the critical nature of keeping recovery data private and offline whenever possible.

What readers should watch next

The coming days and weeks will likely reveal how Coinbase resolves questions about the Commerce page and its recovery-flow references. Watch for:

• Official statements from Coinbase detailing findings from the investigation and any changes to Commerce documentation or user flows.
• Clarifications on whether the subdomain-driven prompt was operational, experimental, or a misconfiguration tied to the broader Help ecosystem.
• Ongoing guidance from wallet providers and security researchers on safe recovery practices, particularly for self-custody setups tied to exchange-backed services.

As the industry weighs this incident, it reinforces a core principle for users and builders alike: seed phrases remain a highly sensitive asset, and even seemingly legitimate interfaces must be treated with scrutiny. The path forward will hinge on clearer recovery mechanisms that preserve user control without creating new opportunities for social engineering.

MVRV data indicate that ETH is undervalued, and previous occurrences of this range have led to substantial gains across multiple market cycles.

Ethereum witnessed fresh losses on Thursday amidst the broader market pullback. The crypto asset shed almost 5%, pushing the price down toward $2,100.

New data suggest that ETH has entered a historically significant accumulation zone, and past data show strong upside following similar MVRV compression levels.

MVRV Drop

Ethereum has entered what analyst Ali Martinez describes as a generational “buy zone,” according to the latest on-chain data. The MVRV Ratio, a metric that compares market value to the average investor cost basis, has declined into the 0.8 to 1.0 range. This indicates a reset to fair value levels. In previous cases, similar conditions have led to major upward cycles for the asset.

Previous instances of this range were followed by gains of 150%, 5,390%, 130%, 280%, and 250%. The current positioning indicates that Ethereum may be nearing a long-term bottom, as accumulation trends are emerging across the network. Martinez’s tweet read,

“On-chain data suggests Ethereum is approaching a long-term bottom. For those with a 12-24 month horizon, the accumulation window is officially open!”

Crypto trader “EliZ” also observed that recent market conditions offered a clear short-term opportunity, where traders who entered positions at lower levels were able to take profits on altcoins. According to the investor, the market is now entering a critical phase defined by important technical levels.

As long as price holds within the $2,050 to $2,180 range on the daily timeframe, the medium-term uptrend remains intact, and continuation is likely. However, a breakdown below the $2,000 level would invalidate this structure.

In such a scenario, market conditions would change, thereby creating a favorable setup for aggressive short positions. This breakdown could open the door for a major downward move and transition from a bullish continuation phase to a bearish trading environment.

You may also like:

ETH ETFs Bleed

On the institutional front, spot US ETH exchange-traded products faced $55.70 million in outflows on March 18 after five consecutive days of inflows. Fidelity’s FETH faced the brunt of the macroeconomic turmoil and incurred the maximum losses with $37.11 million flowing out of it.

Grayscale’s ETHE followed suit with almost $9 million in outflows. VanEck and Bitwise’s ETHV and ETHW were next with losses of around $4.8 million each.

Iran’s IRGC pounds Gulf energy hubs after Israel’s South Pars attack, torching Qatar’s LNG lifeline, affecting crypto markets, and dragging the global economy toward recession.

JPMorgan responded by cutting its year-end S&P 500 target from 7,500 to 7,200 points, warning that oil prices rising more than 30% historically precede demand contractions and recession. Global equity markets fell, with European stocks declining as energy costs surged.​​

U.S. President Trump, who had threatened to “massively blow up” South Pars if Iranian attacks on Qatar continued, shifted tone by Thursday, calling for de-escalation of strikes on energy facilities. The war, which shows no signs of abating, has now placed the Persian Gulf’s energy infrastructure — supplying a substantial share of the world’s oil and gas — squarely in the crosshairs.

Crypto markets cracked alongside the energy spike, with Bitcoin sliding back below $70,000 after trading above $73,000 earlier in the week, while Ethereum dropped toward the low‑$2,200s and broader crypto market value retreated from the roughly $2.5 trillion area as traders unwound leverage and rotated into cash and short‑duration TradFi safe havens.

A new Bitcoin-based finance protocol called Hashi has been introduced on the Sui blockchain, with early participation commitments from crypto institutions including BitGo, Bullish and FalconX ahead of its planned launch later this year.

According to an announcement shared with Cointelegraph, Hashi is designed to let Bitcoin holders earn yield on native Bitcoin (BTC) through onchain lending and borrowing, targeting a segment that currently represents a small share of Bitcoin’s overall market.

The protocol, developed primarily by Mysten Labs, the core contributor to the Sui blockchain, will initially focus on BTC-backed lending, allowing users to borrow stablecoins against their holdings while institutions are expected to supply liquidity at launch.

A Sui Foundation spokesperson told Cointelegraph that the protocol is designed to address structural limitations that have held back Bitcoin’s use in decentralized finance, particularly reliance on intermediaries and limited transparency around collateral.

The system introduces onchain verification and programmatic collateral management aimed at making BTC lending more suitable for institutional use. “We are replacing ‘trust me’ workarounds with onchain verification,” the spokesperson said.

Hashi will enable native BTC to be used directly in onchain financial services without relying on wrapped or synthetic assets, bringing transparency and automated collateral management to Bitcoin finance, components that institutions require to use it at scale.

Bitcoin remains largely unused in decentralized finance, with about 0.22% of its supply, or roughly $3.07 billion, currently deployed in decentralized finance (DeFi) protocols, according to the announcement and onchain data from DefiLlama.