Connect with us
DAPA Banner

Crypto World

Coinbase Commerce prompts seed phrases, raising security concerns

Published

on

Crypto Breaking News

Security researchers are sounding alarms over a Coinbase Commerce page that appeared to prompt users to enter wallet recovery phrases. The episode has reignited concerns that a flow leveraging seed phrases could normalize behavior routinely exploited in phishing attempts, especially when associated with a trusted platform.

The contention began after Yu Xian, the founder of blockchain security firm SlowMist and a prominent figure in security circles, drew attention to the page on X. He questioned why a Coinbase-hosted page would solicit plaintext mnemonic phrases for asset recovery, describing the practice as an unconscionable security lapse.

Coinbase has not publicly explained the page’s origin, beyond saying it is reviewing the matter. The company told Cointelegraph it is looking into the issue but did not offer further information at publication. Yu Xian did not respond by press time, and Cointelegraph has not received a comment from him since initial outreach.

In the crypto community, seed phrases are considered the keys to a self-custody wallet. Users who share them risk handing control to attackers, as the phrases grant full access to assets stored in compatible wallets. The guidance remains stark: never disclose seed phrases to third parties, customer support, or untrusted websites.

Advertisement
Source: Yu Xian (Cos)

Coinbase referenced the subdomain as a commerce “withdrawal tool”

Members of the crypto sleuthing community, including ZachXBT, highlighted that the page was referenced in Coinbase’s public Help documentation surrounding its Commerce product. ZachXBT noted that the guide appeared to describe a method for users to recover funds by importing seed phrases into compatible wallets such as Coinbase Wallet or MetaMask, pointing to a withdrawal tool hosted on the same subdomain that has drawn scrutiny.

The narrative was reinforced by statements in Coinbase’s own Help materials, which describe self-custodial wallets—meaning Coinbase does not have access to seed phrases and cannot recover funds if they are lost. The documentation has since sparked questions about how such guidance aligns with the observed page prompting seed phrase input.

“So basically Coinbase has an official page live threat actors can use to target Coinbase users via seed phrase social engineering if they wanted?”

That line, shared by ZachXBT on X, underscores the potential for a phishing vector that leverages a perceived official pathway to seed Phrase recovery, should the page prove legitimate or be misconfigured. The incident sits at the intersection of user education, platform trust, and the evolving complexity of self-custody workflows.

Why this matters for users and builders

Seed phrases are the linchpin of self-custody security. A page that casually requests such credentials, even within an official-sounding context, runs counter to best practices widely taught by wallet providers and security researchers. For users, it raises the stakes of social engineering campaigns that blend legitimate branding with deceptive prompts. For developers and exchanges, the episode highlights a delicate balance: offering recovery and interoperability features without exposing users to new attack surfaces.

Advertisement

Self-custodial wallets give users direct control over private keys and recovery phrases, but with that control comes responsibility. If a trusted portal inadvertently or inadvertently appears to solicit mnemonic data, users may be tempted to comply, especially during times of asset risk or loss. The incident thus taps into broader debates about how to design recovery flows that are both user-friendly and resistant to manipulation.

Coinbase’s response and the path forward

Coinbase has acknowledged the matter and said it is investigating, though details have not been provided publicly. The company has previously advised users against pasting seed phrases into any website and has emphasized that its Commerce wallets are self-custodial, meaning Coinbase cannot access seed phrases or recover funds if they are lost. The current episode raises questions about whether the page represented an official feature, a misconfiguration, or a security gap in the documentation surrounding Commerce.

Separately, Coinbase has been vocal about warning signs of phishing and social engineering, noting that scammers may impersonate customer support over the phone or online to harvest login details and verification codes. The firm has urged users to stick to official channels on X and Reddit for support. The evolving situation leaves several uncertainties:

  • Was the page a technical error, a misconfigured subdomain, or an actual attempt to steer users toward seed-phrase recovery?
  • Did the referenced help guide reflect current product flows, or has it been altered or removed in response to the scrutiny?
  • What steps will Coinbase take to prevent similar prompts in the future, and will there be updates to Commerce documentation to clarify best practices around seed phrases?

Context from the wider security landscape

Phishing and social engineering remain pervasive risks in crypto, with attackers continually adapting their lures around familiar brands and services. The OpenClaw phishing episode, for instance, illustrated how attackers mix messaging around “free tokens” with authentic-looking interfaces to entice victims. In that climate, any ecosystem feature that touches seed phrases—whether as part of a recovery workflow or a cross-wallet import—demands especially rigorous safeguards and clear user education. Cointelegraph previously covered how security researchers urge vigilance against seed-phrase exposure, underscoring the critical nature of keeping recovery data private and offline whenever possible.

What readers should watch next

The coming days and weeks will likely reveal how Coinbase resolves questions about the Commerce page and its recovery-flow references. Watch for:

Advertisement
  • Official statements from Coinbase detailing findings from the investigation and any changes to Commerce documentation or user flows.
  • Clarifications on whether the subdomain-driven prompt was operational, experimental, or a misconfiguration tied to the broader Help ecosystem.
  • Ongoing guidance from wallet providers and security researchers on safe recovery practices, particularly for self-custody setups tied to exchange-backed services.

As the industry weighs this incident, it reinforces a core principle for users and builders alike: seed phrases remain a highly sensitive asset, and even seemingly legitimate interfaces must be treated with scrutiny. The path forward will hinge on clearer recovery mechanisms that preserve user control without creating new opportunities for social engineering.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links. Read full disclosure

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

Celo Proposes Shifting Opera to ‘Long-Term Stakeholder’ with 160M CELO Grant

Published

on

the-defiant

The move would replace quarterly CELO grants to Opera, which each required Celo governance approval, to a one-time token payment for a three-year partnership.

Publicly traded web browser Opera (NASDAQ: OPRA) announced that it has committed to being a long-term holder of Ethereum Layer 2 Celo’s native token, CELO, according to press release published today, March 19.

Celo Core Co., the primary developer and steward of the L2, submitted a governance proposal today outlining the plan to restructure its five-year-old partnership with Opera, namely proposing to shift the browser giant “from a distribution partner to a long-term network stakeholder.”

If approved by the Celo community, the new structure has Opera set to receive an allocation of 160 million CELO tokens — worth about $13 million at current prices — from the network’s “unreleased treasury,” meaning the tokens would not be purchased from the open market.

Advertisement

CELO rallied over 7% on the day on the news, bucking a broader market slump, though the token remains 99% below its 2021 highs and was trading around $0.08 at time of writing.

the-defiant
CELO 24-hour price chart. Source: CoinGecko

Quarterly to One-Time Grant

Under the proposed deal, Opera would swap its existing quarterly grant arrangement for a one-time token payout that initiates an additional three-year partnership between the two organizations.

In December 2023, the Celo community approved a proposal to pay Opera $568,182 per quarter in CELO — dubbed strategic grants, with each grant put before a governance vote on a quarterly basis — through Q1 2026, for a total of nearly $5.7 million, calculated at the time. The approved 2023 proposal emphasizes that Opera intends to hold and stake CELO, and has the ability to participate actively in governance.

These grants were effectively a marketing deal to increase the adoption of Celo DApps, namely MiniPay, specifically across Africa, where Opera Mini was the most popular browser at the time, per the proposal.

The 160 million CELO allocation in today’s proposal, also presented as “a grant for distribution services,” represents what both firms note is a shift to a more long-term partnership and commitment to the Celo ecosystem.

Advertisement

The allocation makes up approximately 27% of CELO’s current circulating supply and 16% of its 1 billion maximum supply. The one-time token transfer would come from Celo’s treasury into an Opera-controlled wallet, with Opera’s governance influence capped at 10% of total staked CELO under normal circumstance, per the governance proposal.

The proposal has already drawn scrutiny from some in the Celo community. One member of the governance forum, under the username Ginsburg, left a comment on the proposal earlier today, raising concerns about the deal’s structure and requesting further clarity from the team:

“This proposal effectively allocates ~160M CELO to Opera in lieu of a cash payment, which introduces meaningful dilution (or at least supply overhang) for existing token holders. I understand the strategic intent—aligning Opera as a long-term stakeholder and scaling MiniPay distribution—but the key question seems to be whether the expected user growth justifies the size of this allocation. If this were a market purchase, it would clearly signal demand. In this case, it’s more akin to CELO using its token as equity to acquire distribution.”

The vote remains pending before the Celo community governance forum. Opera and Celo also announced plans for a joint roadshow in Southeast Asia and Latin America “to drive grassroots adoption and grow the Mini App ecosystem,” starting next month.

Five-Year Partnership

The original partnership between Celo and Opera began in June 2021, when Opera first integrated CELO and Celo’s native stablecoins into the browser’s built-in crypto wallet, bringing cUSD and cEUR to millions of users.

Advertisement

That relationship deepened significantly in September 2023 with the launch of MiniPay, Opera’s self-custodial stablecoin wallet built directly on Celo, which has since grown to 14 million account registrations and processed 420 million transactions across 66 countries, according to the release.

Celo’s stablecoin activity and user base began surging in late 2024 as MiniPay drove adoption globally. Stablecoins more broadly crossed into mainstream fintech in 2025, with total market cap rising 50% even as broader crypto declined.

According to L2Beat, Celo has approximately $247 million in total value secured, making it the largest chain in the validiums and optimiums category — but a fraction of the scale of major rollups like Arbitrum or Base, which each hold over $10 billion.

Where Celo stands out is in user activity: per Token Terminal, the network currently leads all Ethereum Layer 2s by daily active users, with roughly 660,000 DAUs — a figure Celo attributes largely to MiniPay’s global reach.

Advertisement

This article was written with the assistance of AI workflows. All our stories are curated, edited and fact-checked by a human.

Source link

Continue Reading

Crypto World

Further Gains Ahead or Brutal Collapse?

Published

on

RIVER Price


Certain market observers predicted that the asset’s price could soon surpass $50, while others cautioned traders to be extremely careful.

The lesser-known altcoin RIVER has defied the ongoing bear market, with its price spiking by double digits over the past seven days.

Some analysts expect the rally to continue, while others view the project as a red flag and warn investors to stay away.

Advertisement

How Much More?

RIVER is among the best-performing top 100 cryptocurrencies in the last week, jumping by 50% and currently trading at around $26 (per CoinGecko’s data). At one point, its market capitalization neared $550 million, whereas as of this writing, it stands at around $500 million.

RIVER Price
RIVER Price, Source: CoinGecko

One factor that may have contributed to the rally is the recent partnership between DIA and River, which is intended to provide the former’s omnichain stablecoin system with accurate, trustworthy price data.

The coin’s pump caught the eye of many analysts, including the popular Ali Martinez. Earlier this month, he claimed that RIVER “is looking bullish” since it has formed an “inverse head-and-shoulders” pattern and predicted that a pump above $20 could open the door to $57. Later on, Martinez confirmed the breakout, setting anything in the $45-$57 range as potential targets.

Kamran Asghar chipped in when RIVER was testing the “critical resistance zone” around $23. Back then, he argued that turning this into support could result in a “clear run” toward $40 and beyond.

Major Red Flags?

Despite the impressive price increase, others remain quite skeptical toward the cryptocurrency. X user Julius Elum noted that RIVER “looks good in the chart,” but claimed that it might be a “manipulatable token” by whales. In his view, entry between $10 and $15 is safe, hopping on the bandwagon at around $20 is risky, while the current levels represent FOMO.

Advertisement

You may also like:

“It might be a planned liquidity grab. I don’t chase setups if it has formed this obvious conviction. Because most times, it’s a trap. I’d rather take entry when the conviction is still in the doubt stage. But if I must risk it, I will do so with caution,” the analyst concluded.

X user Nehal also sounded the alarm. They believe that there are major red flags surrounding RIVER, suggesting that investors should be aware of more than just a pump-and-dump volatility. The analyst went even further, stating that many traders have reported losing money because the price has moved against their positions. In a subsequent post on March 18, Nehal forecasted that RIVER could plummet below $5 soon.

Highlighting the risks related to the token is nothing new. Earlier this year, X user Erik said 94% of RIVER’s total supply is held by only five wallets, whereas Honey argued that the project resembles previous rug pull schemes.

SPECIAL OFFER (Exclusive)

Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

LIMITED OFFER for CryptoPotato readers at Bybit: Use this link to register and open a $500 FREE position on any coin!

Advertisement

Source link

Continue Reading

Crypto World

Major League Baseball Inks Deals with US Regulator, Polymarket

Published

on

CFTC, Sport, Polymarket, Prediction Markets

Major League Baseball (MLB) announced that it had signed an “integrity protection” agreement with the US Commodity Futures Trading Commission (CFTC) as it separately inked a deal with prediction markets platform Polymarket. 

In a Thursday announcement, MLB said that its commissioner, Robert Manfred, signed a memorandum of understanding with CFTC Chair Michael Selig following the league’s request for “strong integrity protections in the rapidly evolving prediction market space.” In a separate deal, the league said it had reached an agreement for predictions market platform Polymarket to be its Official Prediction Market Exchange.

“The new agreements that we formed with Polymarket and the CFTC are imperative steps in proactively managing the new and rapidly growing prediction market space,” said Manfred.

CFTC, Sport, Polymarket, Prediction Markets
Source: Polymarket

In August, MLB sent a memo to players and clubs warning them about prediction markets, reminding them that the league’s gambling rules apply to those platforms. In November, two Cleveland Guardians pitchers were charged with sharing inside information about their play with sports bettors.

The deals were announced amid scrutiny from federal and state lawmakers on prediction markets platforms like Polymarket and Kalshi. In the US Congress, lawmakers have named Polymarket in proposed laws to crack down on bets related to military conflicts, while at the state level, both platforms are facing lawsuits related to betting on sporting events without a license.

Advertisement

Related: Bitcoin prediction markets see 70% chance BTC price crashes to $55K in 2026

The baseball season kicks off on March 26 with 22 teams playing across the US. As of Thursday, Polymarket has listed several event contracts for the league’s spring training games.

Will the CFTC agreement prevent state-level lawsuits over sports bets?

Although prediction markets platforms offer event contracts on a variety of topics such as US politics, weather, and pop culture, authorities in many US states have been challenging companies like Kalshi or Polymarket over sports bets and, in Arizona, election wagering. 

Selig, as the sole commissioner at the CFTC, has been publicly pushing for the agency’s “exclusive jurisdiction” over prediction markets, including through the proposal for a rule that could amend or issue new regulations for overseeing the companies.

Advertisement

“Calling a bet an ‘event contract’ doesn’t make it legal,” said the American Gaming Association in January. “Prediction markets are exploiting regulatory gaps to offer unregulated sports wagers.”

Cointelegraph reached out to Polymarket for comment on potential lawsuits over the deal but had not received a response at the time of publication.

Magazine: Are DeFi devs liable for the illegal activity of others on their platforms?

Advertisement