Bitcoin is the currency of the Internet: a distributed, worldwide, decentralized digital money. Unlike traditional currencies such as dollars, bitcoins are issued and managed without any central authority whatsoever: there is no government, company, or bank in charge of Bitcoin. As such, it is more resistant to wild inflation and corrupt banks. With Bitcoin, you can be your own bank.
I get hacked, 2.4 bitcoin stolen from coinomi wallet
hello,
On 28feb2022 I get hacked, 2.4bitcoin from u/coinomi android wallet got stolen.
It's an old Android 7, Samsung Galaxy s6edge (no root).
In 2017-2019 I use u/Coinomi wallet to store my bitcoin because was simple easy to use.
In summer 2019 I decide to use that phone only like a "cold storage" I have u/coinomi app, windscribe vpn and google apps. I choose that because was simple , once a month I power the phone do the update on u/coinomi and the other apps checking the wallet and shut it down.
The u/Coinomi wallet do not have the BIP39 passphrase implement ate at that time but I secure the wallet with a password , with a pin number in case somebody had the phone to be hard to unlock it.
At the end of February2022 I update the u/coinomi wallet to version 1.25.2 build 430 core 220 all work fine update done, I check the wallet the bitcoin was there (I also choose the feature " Mark do-not-spend " in case somebody open the wallet no amount was display ) but today I check the address of my wallet (I have it saved in tor browser to be simple to check the utxo ) and I see the coins were moved
https://oxt.me/transaction/812f73d94bc1eb029e72930427ea27bee4e668accaad4d3fc167a24f1de364a5
how can this happen ? since nobody have access to the phone.
The seed was stored on paper ,nobody see it ,plus I wrote the words in other order so only I can know the right order.
I'm sure something was wrong with the update since is not an open source wallet nobody knows what that wallet can send out butt I think the wallet send the seed out to somebody because passed 3 and half years and the seed was safe inside it only know happen..only after the update.
After 5 hops I saw the bitcoin Is sent to Binance exchange address
https://oxt.me/transaction/2984598d66601f7cf922f819b32da464733ec00bd5e71ce76ca6627fdc97e38f
do not have a binance account but I chat with them to the live chat:
Greetings from Binance security team! We are very sorry to hear about your situation. Upon checking we have found that the funds are in Fixed Float wallet.
The funds appear in the blockchain to have been sent to Binance because Fixed Float is a Binance Broker, this means it is another company that has a wallet with Binance for its liquidity and order book. This broker has many users, so we don't know the exact end user who received your stolen funds, we only know the funds were transfer to the Fixed Float hot wallet.
I know fixedfloat is a noKYC exchange own by russians and many bitcoins come and go to the Hydra Market.
I talk on telegram with the support guy named Angelo and via support ticked but they say that the wallet is working perfect and they are on the market since 2014 and nobody have issues, some years ago I remember a guy that also lose funds from coinomi desktop wallet was a big fuss then but nobody believe it neither I but now I think something is not ok.
My question is how can somebody take the seed from the wallet if that wallet was shut down 95% of the time since summer 2019 ?
I was careful with the coinomi app , always FORCE STOP and only open the app if the VPN was on.
For me is very strange that my bitcoin was stolen after the update.
That update had something that read the seed and sent it out, I can't see other explication.
I just wanna share my experience , I do blame the guys that work on Coinomi , they always say [i]the wallet is safe nobody lose funds it's impossible to be able to see your seed [/i]but the app is not open source so how can this be true ?
Via support ticket they wrote me this:
After looking through the details given we can confirm the transaction was sent from a device where Coinomi was installed. However, due to the nature of cryptocurrency transactions we cannot say 'whom' made this transaction since we are a non-custodial wallet software which means we do not track any sort of user data.
Coinomi is one of the most widely known multicoin wallets and also one of the easiest to use. This means it is more likely than you think for someone to select to restore any seed into Coinomi
Please could you tell me, do you access the app from the same IP all the time? Do you use a VPN?
FixedFloat reply via email:
We're sorry that you were subjected to theft of funds.
FixedFloat is an instant non-custodial exchanger. After the receipt of funds and the receipt of the required number of confirmations, the exchange takes place immediately.
We do not require any personal data for the exchange. We can only request a search of the server logs (IP, user-agent, language) from our technical specialists. But we need an official request from your regional police or other representative, from their official email address in order to issue confidential information.
After receiving an official request from law enforcement, we will be able to send server log data and order data.
Unfortunately, this is the maximum we can help in this situation.
I post this story on reddit they close the post, If i wrote on they telegram group they tell me to stop because the wallet is good.
I think was an inside job.. or can somebody tell me how the hacker get the seed from a wallet that is power off almost all the time?
One of the biggest loss of my life.
Here you can see how the hacker move the bitcoin
https://oxt.me/transaction/812f73d94bc1eb029e72930427ea27bee4e668accaad4d3fc167a24f1de364a5
https://oxt.me/transaction/59448820438e21501673e6c732419a3f1b9a04fcce086ab3638c58238348b0b6
https://oxt.me/transaction/b266a2d1d586f0bcb3bd6c1003969b0930382531d0c166755fd1ed1a1aa5cbc0
https://oxt.me/transaction/67b8563a226c864c12fd059b5ca29f2c9ccb556958b08b2ada1a5de79c6aa677
and then In u/binance u/FixedFloat
https://oxt.me/transaction/2984598d66601f7cf922f819b32da464733ec00bd5e71ce76ca6627fdc97e38f
hey u/coinomi why the app connect to this stranges ips 188.144.96.7 https://whatismyipaddress.com/ip/188.144.96.7
Decimal: 3163578375
Hostname: 188.144.96.7
ISP:
Organization:
Services: None detected
Assignment: Likely Static IP
Continent: Europe
Country: Germany
Decimal: 2539979203
Hostname: 151.101.1.195
ASN: 54113
ISP: Fastly
Organization: Fastly
Services: None detected
Type: Corporate
Assignment: Likely Static IP
Continent: North America
Country: United States
State/Region: New York
City: Brooklyn
A cold wallet that you put online once a month to update apps? Not sure that’s how cold wallets are supposed to work.
Not trying to kick you when you’re down but if you have $100k+ maybe spend $50-100 on a dedicated hardware wallet to store it.
most likely one of the apps had malware? maybe even the AV scanner, or the some phone bloatware!
op should post phone brand and model as well as a full dump of all the apps installed.
I know what you say.. was my mistake that I didn't do it..UI trust the wallet that all will be fine.for 3 years nothing bad happen only now.
in 2017-2019 those bitcoin don't have a bigger value ..I just left it there because...well I'm stupid (I agree with this )
I was sure all my methods work, using a vpn, keeping the wallet with just minimum apps, not internet traffic ,no chat apps, phone was shutdown 99% of the time in last 3years
If somebody had the seed before when bitcoin was 65k why they don't do it?
they do it now because now they got the seed , they have it after the last update of the wallet.
You were using old phone and android stops sending security patches to phones older than 3 years. This means any new vulnerabilities discovered after this time won't be fixed unless it truly a really bad one. Plus, your VPN service could have inside men who only target users who access bitcoin. If you ever accessed wallet on public wifi you also could have got hacked that way.
You made a mistake in having that phone accessible to the Internet. Cold wallet means 0 Internet connection.
Sorry man 2.4 BTC is big loss and chances of recovering it are close to 0%. The faster you can learn and accept it the better. And BTC has many room to grow. If you keep investing you will recover losses and be in the green again.
Was that good bitcoin that I DCA when was under 10k ..that will never happen again.
I feel like my time was stolen..time that i work to get money and put it all in bitcoin.
thank you for you mesage
Your time was not stolen if you've learned a lesson. In your case, a valuable lesson, but not THAT valuable.
There are far more important things than money.
I hope you manage to continue with your life, learn the lessons and put the past behind you. look to the future.
What comes around goes around. Don't worry, what you lose, you gain in some other way.
good luck!
VPN won't stop a key logger on your phone. Antivirus won't work if you have a virus that is smarter than it. Older phones have more vulnerabilities then newer phones.
An exchange with 2/3FA would have been safer then this.
Did somebody have access to the phone? Maybe you threw a party and it was in the drawer? Maybe a friend of a friend of someone you know visited you and had a chance to to start the phone and export the backup phrase?
The phone was into a hidden space plus it can be open only with password , a long one, then pin for open the wallet and then another password before sending.
The only people that knew that I use coinomi wallet and I have bitcoin there is the coinomi team that create the app.
Did you write down your secret backup word phrase? If so, where did you store it? Could anyone have had access to that?
Actually, they don't. It's called a non custodial wallet for a reason. Only you know.
Sorry for your loss. I myself can’t imagine having 2.4 BTC and not putting it in a proper hardware wallet.
This sums it up.
I know but was there since 2019 easy to access ..2.45bitcoin was not that much at that point.
I know is also my fault but is also strange that the hack was done after tthe last update of the wallet.
If soomebody had the seed before he will not wait till now to do it
You had a $200k on your phone, even in 2019 it would have been worth paying $150 to properly protect it.
Hardware wallet not a phone, is very possible is the coinomi update, do you have the IP of where the update came?. Some malware won't show in scanners without root access.
update come from google play store.
Did the IP belong to Google? Hackers can fake updates. Also it could be coinomi itself
See an example of a fake update: wallet stealing app.
https://arstechnica.com/information-technology/2022/03/google-play-app-drops-data-stealing-teabot-rat-on-10000-android-phones/
Yeah it was easy to access, thats for sure :/
That sucks bro, sorry for your loss. I hope this doesnt deter you from moving forward and stacking. You receiving two $13000 transfers in one year makes me think youve got some money coming in so I wouldn't think so but you never know.
July 24, 2019 the price was around 10k USD. Those 0.3 BTC are worth 13k now.
Any device that is connected to the internet is not cold storage.
There are a multitude of ways in which a hacker can steal your funds if your device is connected to the internet.
Cold storage means no connection to the internet, and it's the safest way to keep your bitcoin.
You can setup a watch-only wallet in an internet connected device to interact with your cold wallet easily.
Which hardware wallet and “watch-only” wallets do you use? I’ve been wanting to move mine offline but it seemed complicated so I’ve been procrastinating
It's not hard. Ledger and Trezor are both really easy to use.
Electrum can do both. You can even use a raspberry pi zero as the hardware wallet
Why pi, Can you not just use a USB with TAILS OS offlline PC boot with USB and followhttps://electrum.readthedocs.io/en/latest/coldstorage.html
Of course you can.
I prefer the Pi Zero because it's a fully working computer itself(with the USB you need a separate computer), and it doesn't have networking hardware (no wifi, no bluetooth).
Try mycelium very good watch only wallet
Electrum, very easy to do and put in cold storage. Just need an offline computer that never goes on the internet
For everyone here claiming "It was Coinomi" or "it must have been the update":
Coinomi serves millions of users across multiple platforms. Do you not think if this was an "inside job" there would be thousands more reports of such from the latest application update and there are still many more people holding more than 2.4btc in the Coinomi app (We get many users daily in our support channels holding much more) so would they not have been prime targets?
Whilst it is always a sad thing to hear when a user loses funds. The evidence provided points towards either;
A) an infected/breached user device. Activity sniffer/loggers which have taken passwords from the user device or have used another "0 day exploit" to remotely control the device. or
B) a compromised recovery phrase backup which this user claims was written on paper.
I can only imagine how bad it will get when technologies and computers advance. This is one of the issues QAN is tackling through their blockchain.
So sad for OP losing that huge amount of money.
Open source your app please. There are multiple other ways to combat malicious app reproductions .
It was an inside job, this has happened before. I would suggest OP to file a digital crime claim with their local police, this is a very serious case.
https://www.avoid-coinomi.com/
It is not an inside job. The link you provided links to an old story where a user tried to blackmail and extort our company. We already told the OP to report this activity to his local police so they can begin contacting exchanges and centralised services to have the funds blocked there.
I'm sorry for you loss, truly am. But anyone else out there keeping your coins in a hot wallet, just spend the money and get a hardware wallet. .0032 can get you a decent cold storage wallet! Just do it!
Sorry for your loss.
You have probably learned your lessons, but for the benefits of others to consider, IMO
cold storage - substantial BTC holdings are better held via a mechanism that is truely cold and has no access to interact to/from the internet. Only have watch-only wallets on connected devices.
seed phrase - take the security of seed phrase seriously, exposure of your seed phrase (with passphrase if there is one) means your holdings is accessible by others!
open source - whilst it does not guarantee security, at least there is some better transparency on what’s actually in each software release and not solely relying on the words of the software developer.
avoid mixing BTC with alts - more for those who have substantial BTC holdings yet also have some alts - beware of compromising on what you could do to securely hold your BTC for the convenience of having a single software / device for BTC + alts. Consider is the convenience really worth exposing your substantial BTC to the added complexities / risks of multi-blockchain mixed code base behind the software / firmware?
Agree with all your points
I know u/coinomi is a app for alts but I use it for bitcoin because design is easy but is not open source and this is the big problem.
Personally I have more BTC and only limited alts. BTC mostly held via Coldcard never connected, with watch-only on BlueWallet plus a small stack held via BlueWallet for easy outbound transfers.
I don’t have self-custody for alts yet and still figuring out if I could implement a similar pattern, an air-gapped hardware wallet supplemented by a software wallet that can also do watch-only. But I would shy away from using the same solution for BTC vs alts….
Thanks for sharing re Coinomi, it’s on my list to investigate but if not open source, off the list it goes.
complete failure of judgement sorry for your loss.
I write software and its easy easy to steal with updates.. I REQUIRE THAT PEOPLE DOWNLOAD SOURCE CODE AND COMPILE for anything Bitcoin related.
Comment deleted by user
Coldcard does it by firmware file downloaded to SD card.
i never update my nano ledger with my seed on it.
PERIOD> NEVER!! DO NOT TRUST. VERIFY
I had to buy a new one because of the forced changes.
Time for me to get a Ledger and move from Electrum. My small stack is to the point where it will hurt if it’s stolen.
NEVER UPDATE APPS.
DO NOT TRUST> VERIFY.
Take extensive measures to check updates.. Weeks if not months.
Every update is potentially a virus or a trojan.
Is it possible for trezor firmware updates to be a Trojan? There seems to be frequent updates through trezor suite
ouch.. Yes updates can be malicious. Its an easy attack vector.
CIA storms the building. Points a gun to your head. Tells you to apply this nice little update provided by said CIA. Bam. You are fucked.
do it.don't wait and trust a mobile wallet
Scammers and hackers for profit are truly some of the worst people to exist. I’m sorry to hear about this.
thank you
I'm curios how they do it
Isn't it clear? You used an old, outdated android phone as a hot wallet.
but how exactly they do it ?
How would we know? We don't have your phone and can't inspect it.
One thing I never trust are "multichain wallets" like Coinomi. Those things have endless attack vectors. Next time use a bitcoin only wallet. That goes for hard wallets as well. As well, don't ever store large amounts of bitcoin on anything connected to the internet, like a phone or paper wallet.
It was definitely the update.
Hi there, Coinomi is non-custodial and never has access to user funds. The recovery phrase/keys never leave the user device. We are speaking with this user to try and help them figure out how it may have happened. Thanks
how would anyone know that if your app is closed source lmao
thank you guy in charge of bank of coinomi that adds fake projects like premined eth, go scam yourself
These VPN's are another way to monitor an log what you do. Don't exclude that possibility.
I know that but how can the VPN go inside the wallet and take the see? seed isaes256 encrypted as cooinomi dev say
I don’t get the point of the VPN here in the first place? It just sounds like needlessly exposing the device to a whole other network that’ll no doubt be recording traffic.
I don’t know what happened, but connecting to a VPN for stuff like this is a huge security hole, especially if the android version you used has a known vulnerability.
VPNs are for accessing specific networks that you cannot access otherwise. They do not improve your security or provide you with any privacy. They do the opposite.
Also, cold storage should not touch any network, get an actual hardware wallet!
Depends. If you use a VPN you see advertised on TV you have no security.
they can say anything, it's still closed source and no way to check where else the key might be
I see big security flaws here. I am really not an expert on cyber security, but those are kinda the basics.
Do not connect your cold wallet device to the internet. You lost the BTC in you HOT wallet, which is still a bummer but it isnt something impossibile to happen.
Never use a VPN*, you are just handing over your data to their server. Nice service to have if you want to be anon, but you are basically trusting the people who own the server not to sniff your data. There is no need in using a VPN unless you arent able to access internet without it. And if you need to use it, pay for it and use the most reputable service.
Never use an old phone as hot wallet. The problem is in the software, Android 7 is pretty old and probably full of 0 days exploits (aka they can hack your phone and access it without you even touching anything). Since security patches are not delivered on older androids, it is easier as the time passes to find one cheaply.
What could have happened: Step 1: You use said vpn to access the internet and by doing so you provide the information about your btc holdings and your device. I think the update has nothing to do with it, every time you connected through the vpn you risked someome else sniffing your traffic. Step 2: then the used a 0 days attack and gained access to your device.
Maybe the hacker did step 1 way back and just waited you to connect again in order to proceed with step 2. Sure there are many other ways, this is just one i thought of being possibile.
They can sniff data but how can enter and read the seed ? to see the seed a password is needed.
The only ppl that know I use coinomi and I have bitcoin there is the coinomi team that create the app they have all the data , if is not an open source app so they can read tthe wallet seed and sent it away very simply by passing all the PIN/password I have on wallet
This is the only solution I have in mind now.
You don't understand how things work. Being not open source doesnt mean in any way that they can read the wallet seed or that they can send it away. It is actually impossibile for them*. Closed source means that they own the code and it is not public, *sure they can add a hidden feature to steal your assets but then you would not be the only one victim and people will realize the scam.
I literally told you how the hacker could have gotten away with your btc. Search "0 days exploit" on Google. Basically they can enter your phone without the need of you downloading a virus or opening a link. The hacker after getting in you phone just needs you to type your wallet psw using a keylogger (or just bruteforce it) and there you go they have your seed.
there's still no source to check and if you did have a way to see your users private keys in your closed source app they could just take advantage of taking coins from very few users at a time. Note that it wasn't few 100 bucks they stole, but over 100K worth.
if you are going to trust closed source wallet, might as well trust a bank
Lets start by saying that i only use open source wallets if i can choose. And i never told that you should use it.
The fun part is that MOST of people like you saying that "closed source wallet are stealing your money" are not able and wont ever check the code of their open source wallet to see if everything is all right. You cannot prove whose fault it is, there is no point in accusing anyone unless you find evidence.
S6 is 7 years old. Haven't get a single update from Samsung in the last 4 years. If such an outdated device connects to the internet it once, consider it compromised.
yes is old but 256AES encryption is not so even if somebody hack my phone then how do they extra the seed if they don't have physical access to the device?
My conclusion is that after the last coinomi update they do something and send the seed out
There is another set of keys that are beeing used to decrypt and encrypt your AES256 seed phrase. This is what allows you to facilitate transactions. They are called encryption keys.
Point is , that even if coinomi wanted to steal from you , if you had a galaxy S21- s22 and enabled biometrics , they would not be able to, because the phone itself would securely store the keys to decrypt your seed phrase from the 256AES encryption and coinomi or any wallet that has that feature , would not be able to.
Also your phone might be infected somehow and hackers were able to take your seed phrase or control the coinomi app remotely. Google play store itself has security updates as well. You might even have downloaded a hacked coinomi because your play store itself was out of date.
Since it is very old, it doesn't protect from newer attacks. There was also the specter and meltdown hardware issue.
https://oneandroid.net/how-to-know-if-your-android-will-receive-the-patch-for-meltdown-and-specter/
Phones are much harder to hack than PCs in general. And I have heard people storing 100k+ USD in their PC using a software wallet without issue. 😅(It is wrong to do that , but just saying )
You can connect cold storage device while computer is connected to internet that’s the whole point of a ledger trezor or HW. That’s the point of the device it protects the seed.
And? What are you trying to say?
please DO NOT reply to any dm offering help to recover your funds!
So sorry to hear about your loss, your funds are most likely gone I wouldn’t imagine if myself had 2.4BTC And stored them in a hot wallet
I will not and I know is gone.Just want to share the experience
And I'll not kill myself :)
ps: I already get a DM
You have 383 android apps on that phone!? Bruh...
that's the total amouth oof apps that android have. it count every single app.
You realize that is impossible to install 383 apps? there is no space for that many apps
Ah OK I see. My phone seems to have a similar amount actually now that I scanned it.
Sorry to hear about your loss. If the hackers found an exploit in that wallet a lot of people are going to be out BTC by this time tomorrow.
This is so sad :(
I don´t use this app, but to get it right:You did put your seed in there (at least one time) to see your funds?Or did you only put your public address in there, like when you check it in your browser?
Many say "buy a cold wallet device" like a trezor, but i would prefer to use paper wallet and an offline notebook for any transaction.You have to learn, how this works and it will take a little bit of comfort away. But this method is 100% save.
If you know how (there are many tutorial out there), your seed will never be used on a device with internet connection. This made it 100% secure.
I just noticed you have 382 apps on your “cold” storage phone?! Any of those apps (via malicious update) could have scanned your wallet and seeds. Why have so many apps if you open the phone once a month?
Pro Tip: NEVER UPDATE ANYTHING IF YOU HAVE CRYPTO ON THE DEVICE.
Updates are potential trojans.. rug pulls or hacks.
Horrible advice.
Just don’t store your coin in hot wallets. Your phone is literally a computer on the internet.
Your seed was written down. Where did you keep it exactly?
And the update, were you prompted to do the update by the app?
The seed was in a secure place, even if you had the seed was hard to guess because I change the words order and only I know the exact order.
Ironic.. I update the app to be secure up to date and safe
Ok, so it was the update then not the seed. Where did you find the update? Can you go back into your phone and find the update?
I don't know how it could have leaked you seed. It most likely was a malicious update to the app. Once the app is compromised it can send data directly to their servers somewhere and your funds are gone.
I would highly recommended a coldcard or another specifically designed cold storage device that is never connected to the internet. At least for the bulk of your funds. You can use a phone app for day to day amounts but the majority remains in cold storage.
this.
NEVER UPDATE. DO NOT TRUST! VERIFY!
I bought a new nano ledger because I didn't want to update. I don't trust the process.
You mean you didn't want to update the nano ledger firmware? So you're planning on buying a new nano ledger (loaded with newest firmware) whenever there is a firmware update? Genuine question.
yes. that's my current strategy. considering the value on it. I don't take any stupid risks and updates are IMO one of the biggest risks ever.
But I won't use ledger anymore. They are like a bank now.. You have to connect to their centralized online service to even look at your coins.. They know everything about your wallets. Ledger Live is convenient// But its like a bank down the road.
Which hardware wallet will you be using in the future then? And how are trezors?
This is totally crazy, unnecessary, and actually a huge security flaw.
One of the least secure actions is actually entering a recovery seed. This is how people lose their coin 99.9% of the time.
If you don't trust Ledger, then use a different cold wallet.
you lost me there buddy.
First of all, there is no "recovery" seed. There is a seed that generates wallet addresses. So that security risk of managing your seed is irrelevant to the ledger. That seed can be used in any compatible software like Bitcoin Full Node.
I trust ledger to not leak the seed on brand new packaged products. But I don't trust the updates.. That's a whole different thing. Its philosophical. Updates are big attack vectors.
Updates bricks Bluetooth devices on purpose for example.. Updates make computer slower on purpose etc etc.
If this loses you then I suggest you do more research. Most people lose their funds by typing out their recovery seed in what they think is a ledger/trezor interface but actually it’s not.
If you don’t know this than you haven’t researched how people lose their funds on these devices well enough.
Either way, handling and entering your recovery seed is the most risky thing you do in under normal operation.
Call it a seed or recovery seed. I don’t care. Risk is the same.
What you are doing is extremely risky.
That's what I'm saying the update leak the seed.. why just now and not before ?Tthis happend after the update..the update I make it from google play store
Comment removed by moderator
none of that.
Seed is written on a paper and I change the order of the words so only I can know how to order it back
never allow updates. simple as that.
Its utterly bad to allow updates.. I never update unless the app does not work anymore.
You have been lied to.. NEVER UPDATE
Updates are like viruses.. its new code that you don't know about. Its easy to hijack or rug pull with updates.
Well that’s just horrible advice. Any internet connected device should be kept updated. See zero day exploits.
The problem here is OP treated a hot wallet like a cold wallet.
I never update windows. When i want a new windows.. I buy a new computer.
I never update my ledger. I buy a new ledger when old firmware does not work anymore.
They will and are controlling the world with mandatory updates right now. I don't own my Apple Computer. I don't own my Android phone.. I cannot control whats going on it.
I'm sorry for your loss.
Blag update, I had an #update from supposed Binance, clicked it, crippled my phone
You probably know the saying "don't trust, verify" that implies don't trust anything you can't verify. Therefore don't trust anything that isn't open source
You said you used your phone like cold storage. Except your cold storage wasn't really cold storage. It's a hot wallet because it can leak your seed to the internet. Thr loss was unfortunately due to negligence. Next time use real cold storage and buy a Ledger or Trezor
that's the word negligence and I assume this mistake, like what else I can do? just share my story so others don't trust blindly a close source wallet app
And I am sharing the method of how to not lose crypto. So when readers read this they know there is a safe way to hold bitcoin. And it's not any hot wallet period. If you can connect it to the internet it is at risk. Which is every and any type of hot wallet. Cold storage would protect the seed.
This is the golden rule of crypto... "If you can connect it to the internet it is at risk." That is any phone, tablet, computer, etc. Any hot wallet is subject to leak it's seed by either the user or the company that made the wallet. The only safe way to hold crypro is to use cold storage such as ledger or trezor in which they protect the seed from the internet. Hot wallets do not do this. You don't need your phone on for someone to gain access to your seed and take your crypto from a hot wallet.
Tangem for cold storage is what I like.
Dude I have much much less than you and I bought 3 ledger nano's and using multisig. Sorry for your loss but you're phone is comprised.
Sorry to hear this. I got hacked on my coinbase cold wallet. Could never figure out how this happened.
Galaxy S6 Edge, unsupported for god knows how long, running Android 7, and completely missing years of critical security patches.
That's the kind of thing where you'd have out in the wild RCE / root exploits that require zero interaction. A passively compromised device like that (and no, "AV" apps won't help) leaks any app data, any data loaded in memory (that includes your seed phrase / private key the moment the app is unlocked).
Massive F. Sorry for your loss. I hope anyone reading this doesn't make the same mistakes. If you insist (don't) on using a device like this, keep it OFFLINE.
was offline all the time.just power on for max 5-10min do the damn coinomi app update.
Why this happen only after I update the coinomi app , I'm sure they stole it other option don't exist. If somebody find the seed then it should have the seed from other wallets I had but those wallets are untouched.
Look, we can argue all day long. Exposing a device that is that vulnerable to the internet for any amount of time is pure russian roulette.
You won't be able to prove that coinomi stole your bitcoin given the glaring issue above, I won't be able to help you do that, and no one else can. That's the unfortunate reality.
With open source software, there are generally more eyes watching for exploits and backdoors.
Sorry to hear!
Hi there, As we and other have explained here each and every transaction from the app requires confirmation of your password before being sent (your private keys are kept encrypted at all times with the password, so even if the app wanted, it would not be able to decrypt the keys without the password).
Unauthorized transactions can only be made by a) someone who has access to your seed phrase, or b) someone with access to your device and knows your password. There is no other way. We occasionally receive news of users having their email accounts hacked, giving attackers access to their seed backup files kept on their email or other cloud service. Please review your seed backup security, try to remember if you ever entered your seed on any other wallet, website, form, notes tool, etc; or check if anyone could have accessed the app on your device and knows your password.
One thing which concerns us the most is the use of the VPN on a device you claim is "connected to the network once a month to update" and is only used for coinomi. This does not ring true with the evidence you posted here, it shows you have 300+ applications on your device which would suggest some daily use on this device with this many apps it is becoming increasingly likely that one or more of those apps are possibly stealing data from your device or logging some of your activity. This coupled with the age of your device OS is a huge cause for concern.
We highly recommend you file a report with your local police/cyber crime unit so they can begin the task of reaching out to exchanges and centralised services in the hopes of blacklisting the funds for you whilst investigation takes place.
Kind regards.
I already wrote all about the seed where I store it,
nobody had access to the phone and I don't use that phone for daily use since 2019 when I get a new phone.
There are 382apps in total that's how android samsung come with many small apps..Malware bytes scan all of those
You cannot have 382 apps installed think logic. how can you use 382 apps?
Even if I had a keylogger app I don't unlock the seed that some app had the possibility to take a screenshot Malwarebytes
People should not trust u/coinomi because is close source app. and I'm sure the hack was done from last update..
You don't call me a layer and blame on me...yeah the blame is that I trust coinomi but you can't say that that phone was use for daily activities because was not.. is an old phone..not that fast with a small screen and bad camera that's why I stop use it like a normal phone since 2019.
Hi, In no way are we blaming you for this. It is unfortunate that your device or recovery phrase backup was compromised. We have a few extra points from your comments above;
You may have stopped using the device as a daily driver in 2019 but you had already used the device online and it is possible one of the apps could have exploited you.
If someone uses a keylogger to save your spending password. They do not need to see the phrase once they have remote access to your device they can control and send as if they were you.
the phone was shutdown when the transfer was made..the seed was send out from wallet.
there is not virus.keyloger in my phone. I scan it with antivirus
I never install apps outside google play
once again: if malwarebytes scan over 300 apps that's not mean I install 300 apps , that's something kinda fucked up to install 300 apps from google play, those apps are all from android system.
The seed was send it out from the coinomi wallet after the last updatte.
even if i my phone was compromise with a virus ,I didn't type that password since 2018 because I do not send bitcoin only receive
Wallet have a PIN, wallet have a password before sending.
scan with Malwarebytes your android phone you should see over 300 apps scanned
Don't blame the number of apps from the phone. because the issue is not there.
u/coinomi_brenny
Decimal: 3163578375
Hostname:188.144.96.7I
SP:Organization:Services: None detected
Assignment: Likely Static IP
Continent: Europe
Country: Germany
why u/coinomi app connect to this static ip ?
Hi, if you would kindly edit your posts to remove/redact the IP details that would be appreciated. Respond on your support ticket for further discussion on every question you have so we can keep it all organised/documented and to ensure we do not miss one of your many questions.
Your case is important to us and we will answer your questions in a correct manner. But please try to minimise comments such as "coinomi took my funds" or "it was an inside job" because this is unnecessary FUD.
Regards.
is not a fud is a fact
the ip is public what do you want me to edit?
everybody can see that ip if they insttall coinomi wallet... and you still don't answer my question about that ip.
My concern about the information you are posting is simple. You do not know if any of this information could be relating to some bug or unknown vulnerability. Posting freely all of this without taking the correct approach of redacting things and responding to us in our private stream (ticket) you could be putting others at risk. If you did find a bug or vulnerability there is a procedure to follow to ensure responsible disclosure: https://www.coinomi.com/en/responsible-disclosure/
That being said, tese are connections to our backend microservices which update balances and transactions, so nothing to worry about. These route through cloudflare for obvious reasons. The 151 IP is our connection to receive remote updates of the left side bar and OTA banners in the app.
Again, responding to your ticket with questions you have is the correct and best way to get faster replies and to ensure we do not miss your questions.
Maybe someone did a SIM swap attack on your phone. . . That would give the hacker access to your phone number on a phone they control. From there they can reset passwords and gain access to your accounts.
https://www.gemini.com/cryptopedia/sim-swap-attack-preventing-crypto-fraud
air plain mode all the time (you can see in screenshot )
I don't have 2fa with a sim card , I never use that feature because I know is not safe.
I'm not living in USA, I'm from east europe here we have noKYC prepay sim cards.
I do not have a phone subscription.
At which point does it make sense to move to a cold storage?
Are you selling it this month? If not, put it in cold storage if it's currently worth more than you'd like to lose.
When you have a few thousand USD worth.
If you don't have cold storage now, then at least hold it on a top level exchange and disable withdrawals, only allow whitelisted addresses, authenticator apps, etc.
And if you do get cold storage, you need to understand that protecting your recovery seed is the most important thing. Never type it out. Ever.
If your cold storage device is asking you to type it out because of an update or connection problem, don't do it.
Thanks for the advice, I appreciate!
When you have more than 0
cold storage should be primary storage. only put in hot wallets what you intend to spend soon.
problem is ur using coinomi
Maybe the problem is you’re using an outdated and insecure phone?
If you’re using a phone that is no longer receiving updates, then you should have 0 expectation of security (and hence privacy), because it becomes trivial for any script-kiddy to exploit such devices using known, years-old (in the case of Android 7), unpatched vulnerabilities on your device.
You should have invested in a hardware wallet, or failing that, a secure phone like Google Pixels or iPhones (they’re not perfect, but better than Samsungs, or other brands, which basically lag behind Google Pixels when it comes to updates; iPhones have stricter rules for apps, e.g. no IPC, unlike Android).
Newer samsung phones are on par , or even beat the pixels.Trading blows with Apple as well.
https://www.publish0x.com/my-articles/samsung-s22-goes-all-in-crypto-with-brand-new-hardware-walle-xppgrrp
I feel sorry for your loss, but find it really hard to understand why you did not use a proper hardware wallet... Really confused that you allowed this to happen to yourself. Rule number 1 is not your keys not your coins
Ha ha!
I took it bro thanks for the donation
tell me how you did it :)
Did you use it to pay escorts trick? https://www.reddit.com/r/EscortClientsOnly/comments/t3os6h/comment/hyv9opr/?utm_source=share&utm_medium=web2x&context=3
Damn you got me !
This is just speculation but based on what you wrote, I’d assume it’s either the VPN provider (Windscribe, never heard of it) or someone close to you that knows about your funds. The most simple explanation would be that someone accessed your seed phrase that you wrote on paper (cleaner, friend, family member, etc.)
I don't know how the VPN can enter in my wallet and acceess the seed since the seed is encrypted.
Nobody knew how many bitcoin I had and where I stored it..the only people that know is those from coinomi since they create the app
if somebody have access thee seed they will use it long time ago not just now.
I change the order of the words in seed so only I can know how tto read it
Can you list all the apps on your phone and run a virus scan from a trusted antivirus software?
I have Malwarebytes installed on phone, I scan it no issue found
Also with play protect say "no harmful apps found"
This study from 2019 lists Windscribe having 2 suspicious permissions on Android
https://thebestvpn.com/android-vpn-permissions/
Again, this is just speculation but I cannot think any other explanation for what happened. Like you said, if Coinomi had your seed, why would they empty it now?
You enter your password to get into the app.
Anyone who has control of your phone and can key log it can access your coins.
Your seed being encrypted has literally nothing to do with it.
the phone was power off , when the transfer was made the phone was turn off
the phone was never let turn on without me touching the screen
Start the phone... update if was the case..doing a malwarebytes scan .>>>enter the wallet checking the bitcoin..force close the app..shut down the phone.
no virus no malware was find on the phone after i scanning
Sorry for your loss man.. it must be depressing. I’m not sure if a lawsuit can be filed towards an app developer against crypto hacks.
I want to appreciate you all sharing your experience and help us learn what to do/not do.
I don't intend to open a law suite.... is my fault I trust a close source project
Sorry to hear that. Many google store apps are full of viruses by the way. Also I am pretty sure that a VPN can see everything you do, cannot be trusted. Also with so much BTC it would be good to spread it around like 5 different wallets on different devices just in case.
never keep large sum of money ON YOUR MOBILE PHONE.
buy a hardware wallet.
I don't have what to put in there anymore
The only phone storage I would trust is samsung. I wouldn't trust apps you can get from the play store. Those are hot wallets and vulnerable to attacks all the time. Samsung, while not a cold wallet, is not a hot wallet either. They have their own wallet built into the phone, secured and separated on the chip from the rest of the OS. I watched alot of videos and read up on samsungs wallet in their new phones, its pretty interesting stuff. If I was you I'd get a cold wallet.
Sorry to hear about your loss. I had coin stolen from a software wallet while trying my transition from an exchange to self custody. The wallet maker could not have cared less.
I am in the process of moving off Coinbase to use a BitBox hardware wallet. I've moved a small amount as a test and BitBox seems to work great. Before moving the remainder, I'm waiting on another device and a safe deposit box.
I want to ask what may be a dumb question. Is it possible to hack a hardware wallet app with a wallet app upgrade? Reading this thread made me wonder since I have to connect my hardware wallet to an app in order to use it. Any thoughts or suggestions about security would be appreciated.
If the wallet doesn't have a secure element (bitbox has) , it can be done I believe.
Comment deleted by user
The older the phone, the easier it is to hack.
Sorry for your loss.
Edited: some info that I didn't do much background check, did not want to accuse anyone.
Hi there, the posts you linked are irrelevant to this case. If you search for any other wallet you will also see reports of stolen or lost funds because, as we see day in and day out, people who are bad with their opsec need someone to blame instead of their own mistakes. Please stop trying to create FUD against Coinomi by linking old/irrelevant posts.
Sure. I can delete my post. I apologize. I just wanted to give the op some closure.
Timelines could match this story. https://www.zdnet.com/article/cryptocurrency-wallet-caught-sending-user-passwords-to-googles-spellchecker/
Somebody at Google resigned and took your money?
Edit - seems irrelevant since coinoni says it only applied to their desktop wallet..
I know the story at that time and I don't believe it but now.... things looks different.
Hi, this post is irrelevant since it only affected the beta desktop release and forensic reports concluded this was not the cause of the user lost funds.
This should be a lesson to everyone that if you jump into this game, do not take short cuts. Do things the right way, don’t be lazy. The scammers are not going away, they’re multiplying like cockroaches. A cold wallet is a reasonable price to protect your assets.
Nobody took your seed, there was a virus from one of your 383 apps… virus used keylogger to get your coinomi password, then hacker just logged in and sent your funds away
383 apps counted all the apps that android 7 have,
How can I install 383 apps, there is no space for that many apps.
Plus all the apps that I have installed come from google play, scanned with google trust and I also scan with malwarebytes
1.2 BTC ended at the Binance client with deposit address bc1q5w6g3tk6lejlkdzk8ly5dlrsxv62n33kugy7ve according to my forensic tools. Go to law enforcement and ask them to freeze the stolen funds at Binance. This goes usually fast but not if you approach the exchange (they don't know if it was a fraud). If they cannot freeze anymore anything then they should get the id because the trade amount requires KYC.
I talk with binance and they say
Greetings from Binance security team! We are very sorry to hear about your situation. Upon checking we have found that the funds are in Fixed Float wallet.The funds appear in the blockchain to have been sent to Binance because Fixed Float is a Binance Broker, this means it is another company that has a wallet with Binance for its liquidity and order book. This broker has many users, so we don't know the exact end user who received your stolen funds, we only know the funds were transfer to the Fixed Float hot wallet.
I know fixedfloat is a noKYC exchange own by russians and many bitcoins come and go to the Hydra Market.
Tracing yor transaction leads to more than one Binance address. Did they make this statement as well related to address bc1q5w6g3tk6lejlkdzk8ly5dlrsxv62n33kugy7ve ?
Binance will never help a private person without filing a complaint at police. They cannot know if it was a fraud or a legit business where someone regrets that the bitcoin were spent. Therefore police should approach them. It the funds end up in a binance hot wallet then Binance can freeze the scammers funds.
binance reply that they can do shit. funds was already changed using fixedfloat , what can they frez if they already swap the coin.
fixedfloat is nonKYC exchange
sorry for your loss
i'm assuming your phone, which was past end of life and not receiving security updates had malware. you also had 382 apps any which could of delivered malware to your device.
Yeah.. That's not a cold wallet, nor does it even vaguely resemble one. I can't believe someone with 2.4BTC was so careless, incredible..
382 apps... sorry for your loss bro but this one is completely on you
count every app that the phone app and those are android apps
How can I use 382 apps? there is no storage for that many
such amount should be properly secured. if it went to the user via no-kyc exchange most likely you will not see your funds ever
Comment removed by moderator
fuck off with this shit!
Sorry for your loss! Coinomi is better to avoid. After the spell checker story i did some tests by myself to see the wallet secure. Created test wallets, tried to restore, erase, tested seed phrases created on other wallets… found some bugs: the first is if you restore your seed phrase created on other wallet the coinomi wallet give you another adress and you are lost! Game over. Only if you come back to other app you can go to the funds… after that i stopped and give up. I did not the reversal but if you create a seed on Coinomi probably you will use only on it… one day if it shut down you will be by your own. Avoid also any google software or search, they retain the maximum data as most as they can! Piece and good luck to recover from your loss.