A recovery phrase is a powerful credential. Coinbase says it does not have access to a wallet's recovery phrase and cannot move assets or restore access on your behalf if the phrase is lost. Anyone who obtains it may be able to control the wallet.
Keep the phrase out of websites and messages
- Never send it to someone claiming to be support.
- Never paste it into a website, search result, chat, or unsolicited form.
- Be cautious with screenshots and cloud notes; use a backup method you understand and can protect.
- Do not follow urgent instructions from a person who contacted you first.
Check dapps and wallet requests
Type or verify a dapp's address before connecting. A connected dapp may see your public wallet address and information already visible onchain. Read each wallet prompt, including the network, asset, destination, and permissions. Decline requests that do not match the action you intended.
Unexpected tokens or messages can be used to lure people to malicious sites. Do not visit a link just because a token or message appeared in a wallet.
If the phrase may be exposed
Coinbase's security guidance says to move assets to a secure address immediately if a recovery phrase is compromised, then create a new wallet. Treat a possible exposure seriously and use official help resources reached directly, not a link sent by a stranger.
Read the official recovery phrase guide and scam prevention guidance for current details. This independent article is general education, not financial or security advice.
