Back Panewslab

Coinbase Commerce's asset recovery page sitemap also has flaws and is at risk of phishing attacks.

Panewslab • March 19, 2026

PANews reported on March 19 that after SlowMist founder Yu Xian disclosed the risks of Coinbase Commerce's asset recovery page directly requiring users to enter plaintext mnemonic phrases, SlowMist's Chief Information Security Officer 23pds added that the page's sitemap also has flaws. Malicious attackers can easily use tools like ResourcesSaver to download the front-end code and deploy similar websites. If these websites are combined with domains like Coinbase for phishing attacks, users can easily fall for the scam.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Coinbase Faces Criticism Over Unsafe Seed Phrase Recovery Page On March 19, 2026, security analysts flagged a Coinbase Commerce subdomain that prompts users to enter their mnemonic seed phrases in plain text for asset recovery. Experts, including SlowMist's founder Yu Xian, criticized this practice as it exposes users to social engineering attacks. The page was part of Coinbase's wind-down process ahead of a March 31 deadline, increasing urgency for users to recover funds. Blockchain investigator ZachXBT highlighted that this setup could be exploited by threat actors to target Coinbase users. The page's flawed design, including a problematic sitemap, allows attackers to replicate it for phishing scams. Coinbase has not yet responded to these concerns or removed the page. Previous reports indicated that users lost over $65 million to social engineering attacks in early 2025, raising alarms about the potential for renewed scams. The situation remains critical as the deadline approaches. 6 sources 65

Extracted Entities

Coinbase Commerce's asset recovery page sitemap also has flaws and is at risk of phishing attacks.

The full story

Extracted Entities

Attack Types (1)

Companies (2)

MITRE ATT&CK (1)

Tools (1)