A Coinbase subdomain linked to its Commerce tool reportedly directed users to a withdrawal page asking to enter their seed phrases, raising concerns among security observers.