Pages:
Author

Topic: I get hacked, 2.4 bitcoin stolen from coinomi wallet (Read 617 times)

legendary
Activity: 3500
Merit: 6320
Crypto Swap Exchange
coinomi is an open-source wallet that guarantees some level of security
Please actually read the thread before hitting reply. There is extensive discussion in the previous posts about how Coinomi absolutely is not open source and has had a number of very significant vulnerabilities in the past (transmitting seed phrases to third parties, not encrypting communications, etc). Further, no wallet can guarantee your security since even the best hardware wallets or cold storage can be used in an insecure way if the user does not know what they are doing.

In a nutshell, if coinomi wallet is used properly and in a secure manner, it is still vulnerable and we can lose our funds? If you can give a short summary on this , it will be really help because i do have coinomi wallet in my phone with little funds.  Sad
 

Short Version:

coinomi is closed source so there is no way to know what it is doing in the backgroud
Their desktop version also had a major whoops at one point in time and was sending your seed phrase out to google to be spell checked

Long version, no matter what people tell you phone wallets are vulnerable. Some more then others, but in the end you are reliant on the security of Android or iOS to be safe.

Both have had many many issues over the years are are still shown to be vulnerable to attacks.

Android is a bit worse in some ways since it allows for phone manufacturers to put whatever they want on it, better in other ways since you as the user have a lot more control in what the phone has on it.  iOS is a bit more locked down, but Apple has had their share of security issues over the years and for the most part deny it's a problem till they are forced to fix it.

So in the end they both suck.

Don't store more on your phone then you are prepared to loose.
Or as I said above, as a rule that works for me, I don't store more on my phone then the phone itself is worth.

-Dave
sr. member
Activity: 1022
Merit: 280
coinomi is an open-source wallet that guarantees some level of security
Please actually read the thread before hitting reply. There is extensive discussion in the previous posts about how Coinomi absolutely is not open source and has had a number of very significant vulnerabilities in the past (transmitting seed phrases to third parties, not encrypting communications, etc). Further, no wallet can guarantee your security since even the best hardware wallets or cold storage can be used in an insecure way if the user does not know what they are doing.

In a nutshell, if coinomi wallet is used properly and in a secure manner, it is still vulnerable and we can lose our funds? If you can give a short summary on this , it will be really help because i do have coinomi wallet in my phone with little funds.  Sad
 
legendary
Activity: 2268
Merit: 18711
coinomi is an open-source wallet that guarantees some level of security
Please actually read the thread before hitting reply. There is extensive discussion in the previous posts about how Coinomi absolutely is not open source and has had a number of very significant vulnerabilities in the past (transmitting seed phrases to third parties, not encrypting communications, etc). Further, no wallet can guarantee your security since even the best hardware wallets or cold storage can be used in an insecure way if the user does not know what they are doing.
hero member
Activity: 1008
Merit: 520
Leading Crypto Sports Betting & Casino Platform
Hack and phishing attack is one of the attacks that we need to protect ourselves against be careful on the site you visit as per time if you receive any link make sure to check before you click on them, coinomi is an open-source wallet that guarantees some level of security unless someone has access to your private key and have used it to gain access to the wallet.
legendary
Activity: 3500
Merit: 6320
Crypto Swap Exchange
I'm going to take this a step further and go with, don't use phones that have a ton of manufactures bloat and customization on them.
Just don't use mobile wallets for amounts you are not willing to lose.

Are you comfortable carrying around $50-100 in cash in your wallet? Yes? Then you should be comfortable carrying around 0.001 - 0.002 BTC in your mobile wallet.
Are you comfortable carrying around $10,000 in cash in your wallet? No? Then why are you carrying around 0.25 BTC in your mobile wallet?

I use an open source mobile wallet several times a week. How else am I going to spend bitcoin when out and about? They are a necessity. But I also don't store my entire stash in one, just like I don't carry around all the fiat I own in my pocket at all times, which would be plainly moronic. Put your funds in cold storage, and transfer small amounts to your mobile wallet as and when required.

No, its not just BTC using older phones with all the bloat leaves you with tons of other security issues too.
Password leaks, PII being sent who knows where, etc.

-Dave
legendary
Activity: 2268
Merit: 18711
I'm going to take this a step further and go with, don't use phones that have a ton of manufactures bloat and customization on them.
Just don't use mobile wallets for amounts you are not willing to lose.

Are you comfortable carrying around $50-100 in cash in your wallet? Yes? Then you should be comfortable carrying around 0.001 - 0.002 BTC in your mobile wallet.
Are you comfortable carrying around $10,000 in cash in your wallet? No? Then why are you carrying around 0.25 BTC in your mobile wallet?

I use an open source mobile wallet several times a week. How else am I going to spend bitcoin when out and about? They are a necessity. But I also don't store my entire stash in one, just like I don't carry around all the fiat I own in my pocket at all times, which would be plainly moronic. Put your funds in cold storage, and transfer small amounts to your mobile wallet as and when required.
legendary
Activity: 3500
Merit: 6320
Crypto Swap Exchange
...
3. DO NOT use old phones with outdated software
...

I'm going to take this a step further and go with, don't use phones that have a ton of manufactures bloat and customization on them.
It's just too easy for bugs to be found years after support from Samsung / Motorola / Nokia / whoever has ended.

Stock basic Android is just that, there will be vulnerabilities found over the years after support has ended. But, they will probably not be as big a show stopper as all the added manufacturer and carrier bloat.

https://eprint.iacr.org/2022/208.pdf

-Dave
legendary
Activity: 2268
Merit: 18711
But don't you think Mycelium and Exodus are relatively safer than other smartphone wallets?
Exodus is also closed source, so no, another poor choice. Mycelium maybe "relatively" safer, as you say, but all hot wallets and inherently more risky than cold wallet or hardware wallet alternatives.

Even if we buy a hardware wallet from the ledger nano or trezor official website how can we be sure that the device is not compromised on it's way to the customer.
Each hardware wallet has their own way of verifying that it has not been tampered with, from tamper-proof packaging to cryptographically secure handshakes with the manufacturer's servers. It all depends on which hardware wallet you have purchased.
hero member
Activity: 2702
Merit: 716
Nothing lasts forever
I am planning to delete the smartphone wallet from my phone now since I already have the backup of the seed.
Note that that doesn't really make your coins any safer. The seed phrase was already generated in a hot wallet and has been stored on a device with internet access for a period of time. Deleting the wallet app might also not actually delete the wallet file or other data, and it certainly won't overwrite those sectors of your phone's storage. If you want your coins in an offline wallet with the seed phrase only stored on paper, then you need to create the seed phrase and wallet using an airgapped device in the first place.


Yeah I agree with you. But don't you think Mycelium and Exodus are relatively safer than other smartphone wallets?
Also, the smartphone is going to stay with me forever. Now since I have deleted the apps I will be completely wiping the data by doing a factory reset.
I guess that will lower the risks when compared to it's previous state.

Wanted to ask you one thing. Even if we buy a hardware wallet from the ledger nano or trezor official website how can we be sure that the device is not compromised on it's way to the customer.
legendary
Activity: 2268
Merit: 18711
I am planning to delete the smartphone wallet from my phone now since I already have the backup of the seed.
Note that that doesn't really make your coins any safer. The seed phrase was already generated in a hot wallet and has been stored on a device with internet access for a period of time. Deleting the wallet app might also not actually delete the wallet file or other data, and it certainly won't overwrite those sectors of your phone's storage. If you want your coins in an offline wallet with the seed phrase only stored on paper, then you need to create the seed phrase and wallet using an airgapped device in the first place.

This is a strange incident and i am really worried that if this could happen with Coinomi wallet, then other non-custodial wallet are also not save ?
No wallet can guarantee 100% safety, and every wallet will only be as safe as the person using it. However, any open source software which is extensively and continuously examined by thousands of people, such as Bitcoin Core or Electrum, is likely going to be far more secure than some closed source wallet like Coinomi which makes basic errors such as sending your seed phrase to third parties and not encrypting its communications.
newbie
Activity: 16
Merit: 0
Coin is hard to recover,Buy a lesson. You can't use this wallet to save money. The more functions, the lower the security performance,This is common sense.
hero member
Activity: 1008
Merit: 520
Leading Crypto Sports Betting & Casino Platform
There is a high possibility of an inside hack from the wallet source as the update may have been built with bugs that allow access to users' wallet security key or phrase, going by ops explanation haven't stored the Bitcoin on that wallet for over three years and losing it shortly after an update of the app is an obvious cause. You need to report this issue to the appropriate security for proper investigation and possible action to prevent future occurrences of similar hacking.
legendary
Activity: 3262
Merit: 1614
#1 VIP Crypto Casino
Probably try reporting to the authorities. You've probably lost enough money to make hiring a lawyer worth it.

But really mate. I wouldn't want to kick you down as you've already lost money, but with 2.4 BTC why don't you have a hardware wallet? And worse — of all choices, you've decided in using a closed source wallet software.

^^
This

Or at the very least, an encrypted wallet.dat
OP I am sorry for your loss, I hate reading these kind of things but you could have avoided this with better security practises.
jr. member
Activity: 38
Merit: 6
The funds have moved to Binance is a bit of a claim.
yes, one part of the funds have gone eventually to this wallet https://glasschain.org/btc/wallet/111462198
and from there have been moved to binance. However, this wallet was used way before your coins were stolen and much more bitcoin has been moved to binance.

It doesn't mean this wallet owner is the thief. It can be that he just sold something to someone and actually in this case, it can be likely as again, this wallet had other coins in it for years. Btw this can be true before for the hopping. Yes it looks like hopping but you just never know.
In this case though I would say it was just "hopping". which i still don't understand why users do that?

Is there any benefit from hopping? I can't see how this would help to disguise stolen funds. Please someone educate me.



I contact binance on the chat and they said:


Greetings from Binance security team! We are very sorry to hear about your situation. Upon checking we have found that the funds are in Fixed Float wallet.
The funds appear in the blockchain to have been sent to Binance because Fixed Float is a Binance Broker, this means it is another company that has a wallet with Binance for its liquidity and order book. This broker has many users, so we don't know the exact end user who received your stolen funds, we only know the funds were transfer to the Fixed Float hot wallet.


I know fixedfloat is a noKYC exchange own by russians and many bitcoins come and go to  the Hydra Market.
newbie
Activity: 25
Merit: 1
The funds have moved to Binance is a bit of a claim.
yes, one part of the funds have gone eventually to this wallet https://glasschain.org/btc/wallet/111462198
and from there have been moved to binance. However, this wallet was used way before your coins were stolen and much more bitcoin has been moved to binance.

It doesn't mean this wallet owner is the thief. It can be that he just sold something to someone and actually in this case, it can be likely as again, this wallet had other coins in it for years. Btw this can be true before for the hopping. Yes it looks like hopping but you just never know.
In this case though I would say it was just "hopping". which i still don't understand why users do that?

Is there any benefit from hopping? I can't see how this would help to disguise stolen funds. Please someone educate me.

jr. member
Activity: 38
Merit: 6
I scan my phone with 4 anti viruses app , no viruses at all







with "no root firewall" app  I check where coinomi connect, on which ip's.



the ip  https://whatismyipaddress.com/ip/188.144.96.7  looks kinda strange

ps:one of coinomi moderator from  reddit ask me to remove the ip address from the comment!
legendary
Activity: 3668
Merit: 6382
Looking for campaign manager? Contact icopress!
The point of cold storage is to never ever go online. This also means no more updates.
Isn't it applicable to air-gapped laptops that you can update offline? Like, download it into a flash drive then just update the software? I was thinking of the same thing when it comes to air-gapped phones. So updates don't necessarily mean connecting online.

Updates usually happen online. I don't know if not rooted smartphones can be updated offline at all. So I find your case rather unlikely. Not wrong, but rather unlikely to be used.

Also, I don't see why would update be needed at all. If that's a cold storage, you most probably don't use it for anything else. Since it's offline, newer/safer versions of whatever are not needed.
Imho the only case an update would be needed is that the wallet software made a significant leap and the older transaction files no longer work.

And in such a case (you want to update anything) my advice is wipe the disk (not just reformat), reinstall everything fresh, go offline for good, then restore wallet from seed.
And this won't work with a smarphone-as-cold-storage since "reset to defaults" simply cannot be trusted it will properly clean, hence it's a risk. So for this case some cumbersome solution is needed, probably consisting in a separate safe cold storage and 2x fund transfers for the update to be done properly. And yes, this means the initial cold storage is considered compromised (again, this is only in case of smartphone).
legendary
Activity: 2026
Merit: 1034
Fill Your Barrel with Bitcoins!
Good lesson for others not to use your phone as cold storage. Paper Wallets (private key written down) are the way to go.
copper member
Activity: 2940
Merit: 1280
https://linktr.ee/crwthopia
The point of cold storage is to never ever go online. This also means no more updates.
Isn't it applicable to air-gapped laptops that you can update offline? Like, download it into a flash drive then just update the software? I was thinking of the same thing when it comes to air-gapped phones. So updates don't necessarily mean connecting online.
hero member
Activity: 2688
Merit: 588
Hacked is a serious problem in cryptocurrencies, cases of hacked private keys, hacked accounts on exchanges and many more make us to be alert, few days ago my Google metamask was also hacked and made me lose around $500 and the best thing is to create a wallet then we write private manually on paper, make sure there is no internet connection then we take a photo and save the data.
Wait, private key? The one which composed of a long characters? But, they are too much for you to write manually and what if you missed one letter or you didn't capitalize some of them? But, you're going to take a photo with it anyway though taking a photo or a screenshot of our private keys is not also recommended because someone can browse your gallery.

You have been hacked because maybe you have clicked on the random links which promise you to earn some money or maybe you are going to use a known website but you didn't check its url and you got phished. Storing your keys in an offline environment is much safer though.
Pages:
Jump to: