Topic: Warning: Jaxx Wallet - page 2. (Read 8090 times)

Thank you for posting, just moved my assets.

The response from the Jaxx team is flat out disgusting.

Over $400K stolen from poor security on their code where anyone with access to that pc can snatch up the backup phrase and steal the funds, and they think nothing is wrong with it.  

Whats more the backup phrase is not encrypted with a password so if they get the backup..your screwed.

According to a report from Vx Labs, a vulnerability that allows hackers to steal cryptocurrencies from users has been discovered in popular cross-platform cryptocurrency wallet Jaxx, and has reportedly already led to $400,000 being stolen.

The report, published on Friday, shows its possible for hackers to extract a 12-word backup phrase, copy it, and then use it to restore the user’s wallet with all the private keys in it, so then all that’s left to do is transfer the funds to a wallet the hacker’s wallet.

The report reads:

Even when your Jaxx has a security PIN configured, anyone with 20 seconds of (network) access to your PC can extract your 12 word backup phrase and copy it down. Jaxx does not have to be running for this to happen.

Monero developer Riccardo “FluffyPony” Spagni tweeted about the report, presumably so something could be done about the vulnerability now that it was public, but nothing was done before users started reporting lost funds, as hackers took advantage of the vulnerability.

An update published on Altcoin Trading shows that users have already reported losing as much as $400,000 in Bitcoin, Ethereum, Ethereum Classic, and Zcash. Users who only use Jaxx on their smartphones are reportedly safe, although those who use desktop versions of the wallet may be at risk.

Jaxx on Security

On Reddit, Jaxx & Decentral CTO Nilang Vyas stated that Jaxx is a hot wallet in which users shouldn’t keep large amounts, and that they believe to have found a balance between easy-of-use, security, and portability.

The CTO asked users not to use Jaxx if they are not comfortable with its security model, stating:

Please please please, if you do not feel comfortable with our security model do not use our products. We’re are creating for the masses a multi-platform, multi-coin interface for the blockchain ecosystem where users are in full control of their digital lives.

According to the post, the team behind Jaxx is “very comfortable” with its security model for hot wallets, and recommends users store large amounts of funds in hardware wallets. At the end of the post, he pointed out that in the future users will be able to secure their wallets using Trezor, Ledger, and Jaxx hardware wallets.

Based on the Nilang’s response, Vx Labs recommends users stay away from Jaxx if it does not fix the vulnerability.

Please rest assured that your funds are safe in the blockchain.

We're currently experiencing some issues with Litecoin, Zcash, Dash, Doge due to some 3rd party services. Please keep a close eye on our Twitter page at Jaxx Support Twitter for updates on when it's back fully functional.

For support inquiries please reply to this email instead of posting on Twitter as we use Twitter mainly for status updates and public announcements.

Thank you for your understanding!

Jaxx Support

@Jaxx_Support  20 hours ago
 We are currently experiencing w/ our 3rd party service which is affecting #LTC, #ZEC, #DASH & #Doge. We're working on resolving this ASAP!

@Jaxx_Support  10 hours ago
 Today light DDOS attack affected services. Cloudflare is holding up but small % of TX not going thru. Will update soon. Most services Ok.

I recently started messing with Jaxx wallet for a couple of alt coins and noticed today that one of the instances of the wallet, specifically the chrome plugin, quit updating the Zcash wallet after an extension update on May 25th.

I can still access the wallet from the desktop application and by other methods but I figured I would open a support case with Jaxx regarding the chrome issue since uninstalling/deleting the plugin/resetting the cache had no effect on my system. I did some reading online and found other people with similar issues that appeared to have self resolved over time while others indicated they had to contact support.

So contact support I did and here is the canned message I got



Notice that part in bold... all I can say is "Wow" when I read that piece. Jaxx is very up front about this in their support case canned e-mail but no where on their website do they say "Hey miners, don't use our wallets"

Thought I would pass this info on as a warning to those out there using this platform for mining payouts.

Your ticket request has been received. Our team will get back to you as soon as possible. Please bear in mind that due to the unexpected growth that we as well as blockchain technology are experiencing, we have been overloaded with support requests and will take between 24-48 hours to respond instead of our usual 8 hours.

We understand your concerns and are grateful for your patience; please know that we are working on improving our customer success process in order to provide the best attention possible and keep setting the standard for the industry.

Please note that we have a comprehensive Help Centre which can answer most questions. Take a moment to visit the page below to see if your question can be answered:

FAQ page: https://decentral.zendesk.com/hc/en-us

Here are some of the most common issues that users are currently experiencing:
1. ETH transactions showing up in the ETC wallet
2. Ethereum Classic (ETC) send not fully functional
3. Golem (GNT) send not fully functional
4. Bitcoin (BTC) blockchain network extreme congestion (industry-wide issue)
5. ShapeShift transactions not being received right away (ShapeShift congestion)

We are aware of these issues and will have a fix for you soon. If your issue is BTC related, please increase your mining fee to Average or Fast (Settings) for faster confirmations.

**Please also note that we do not recommend that you point your mining payouts to any of our services. Receiving payouts may cause issues on your end and potentially on our end.**

If you find your answer before we reply, we’d greatly appreciate it if you’d let us know by replying to this email.

Thank you for your patience. You’ll hear from us soon!

Decentral Customer Success Team