SlowMist Founder Raises Security Concerns Over Coinbase Recovery Page

The cybersecurity community has raised significant alarms regarding a specific asset recovery interface on the Coinbase platform. On March 19, 2026, Cosine, the founder of the prominent blockchain security firm SlowMist, publicly questioned a Coinbase page that reportedly requests users to input their plaintext seed phrases. The security expert described the existence of such a request on a major exchange's subdomain as highly irregular, sparking a broader discussion regarding institutional security standards and the protection of private keys.

Questionable Security Practices on Subdomains

The controversy began when Cosine took to social media to share his discovery of a Coinbase recovery page that asks for sensitive information in an unencrypted format. According to the SlowMist founder, the practice of requiring a 12 or 24-word recovery phrase to be entered directly into a web interface is fundamentally at odds with established industry best practices. He noted that the implementation seemed so out of character for a regulated entity that he initially suspected a DNS hijack or a sophisticated phishing attack on the Coinbase infrastructure.

"This kind of insecure practice is inconceivable. I almost thought the subdomain had been hacked", Cosine stated on X.

The primary concern revolves around the vulnerability of seed phrases when entered into a browser environment, where they can be intercepted by malicious extensions, keyloggers, or through server-side vulnerabilities.

Implications for User Asset Safety

In the cryptocurrency ecosystem, the seed phrase represents the absolute control over a digital wallet. Security protocols typically dictate that these phrases should never be shared or entered into any online form. The current situation highlights several risks:

• Plaintext Exposure: Data entered in plaintext can potentially be cached or logged by intermediate network layers.
• Phishing Normalization: When legitimate platforms request seed phrases, it may inadvertently train users to comply with fraudulent requests from scammers.
• Centralized Risk: Storing or transmitting private keys via web forms creates a centralized point of failure for self-custody assets.

Industry experts emphasize that reputable hardware wallets and decentralized applications (dApps) use secure elements or local signing to ensure that the private key never leaves the physical device or the local encrypted environment.

In conclusion, the critique from SlowMist underscores the ongoing tension between user-friendly recovery processes and the rigorous security requirements of the Web3 space. As of the time of reporting, the community awaits a technical clarification from Coinbase regarding the architecture of this recovery page and the measures taken to prevent the compromise of user credentials. This incident serves as a critical reminder for investors to exercise extreme caution whenever a platform requests the direct input of a mnemonic phrase.