A flaw in Coinbase's systems cause the information of some merchants to be exposed. Any merchant who created a buy now button, donate button, or hosted a payment page using Coinbase's merchant Tools and posted a public link to it online had the varlet publicly visible on the internet. The varlet contained the companion name, website, phone number, email address, and mailing address. Additionally, anyone could look for public Coinbase merchant defrayal pages and collect the email addresses of merchants. at least ace phishing attack targeted merchants with an email that appeared to amount from Coinbase.