Bitcoin Forum

This is a heads up for those who don't browse Reddit frequently and are not aware of the current situation: https://www.reddit.com/r/Bitcoin/comments/72yvnj/so_coinomis_official_response_on_the/
The developer who found the exploit was accused of spreading FUD by Coinomi and they also blocked him from Twitter even though he posted this almost two weeks ago: https://github.com/Coinomi/coinomi-android/issues/213 I would advice everyone to stop using their wallet for the meantime, I'm sure you could find better alternatives until this get fixed (If they ever do it).

They handled the situation very badly by ignoring the issue for days and acting like a child at twitter, but the good news is that they plan to fix those issues (incase you still want to use Coinomi);

Source: https://github.com/Coinomi/coinomi-android/issues/213#issuecomment-332519079

Guys are you sure about the issue. I have a friend who is being used this wallet for sometime. I feel fear about this now. Let me clear about thread information to him now.
If the issues has been fixed and we can use it else it would not be good like bit.ac

Sorry, but don't understand, what's the issue. Are seeds or private keys of all addresses published? Only see responses, not the issue itself.

Read the issue posted on GitHub.

"Connecting to these servers shows they are unencrypted without SSL... Does this mean your Android app is making all Electrum requests in plain text?"

"[...] So basically opening the Coinomi app is broadcasting all of my Bitcoin addresses in plain text over the network."

---

And from this reddit post[1]:


[1] https://www.reddit.com/r/Bitcoin/comments/72lmql/security_warning_coinomi_wallet_transmits_all/

Thanks for sharing it around.I went through the issue raised on their GH page and it seems quite relevant.Even their official contributor isn't sure if they are using an SSL.However,I don't think that issue is likely to broadcast your private keys over the network.From the first couple of comments only the public addresses are being broadcasted.Let's see how this turns out.

You have to read the issue from the day it was raised,don't just read the comments.Also check the issues those were referenced in that thread.

Thank you for the heads up... and really thank you for posting in a rational manner.  You posted a link, summarized it, and let us decide whether or not we should take action.  Refreshing change of pace from the FUD posts we get, "ZOMG!  Wallet hacked!!!1 All your BTC scammed!11!!"

Hey thanks for the heads up. I'm thinking of using Coinomi but this issue should be fix first. I'll just stick with Electrum for the meantime. This guy has a valid point and calling him FUD'ster and schill is inappropriate. He is helping the community not the other way around.


For the sake of those members you have reading problems.

1. The guy monitored all network traffic while opening the Coinomi app on his phone.
2. He did a search on the captured packets.
3. It ended matching a packet, which when decoded.
4. Is a electrum communication happening in plain text.
5. Following the full TCP stream from start to finish shows the following decoded messages being sent in plain text
6. Basically opening the Coinomi app is broadcasting all Bitcoin addresses in plain text over the network.
7. Meaning none of which are using SSL.

So definitely there are vulnerabilities in their wallet and should be fix ASAP.

Ouch, I just installed Coinomi a few days ago and using it now. Thank you for notifying the community. Will move my coins now to a more secured wallet. I hope they treat this as priority otherwise it will ruin their reputation and the way they handled that guy is very unprofessional. As per twitter:

But at least give it a priority otherwise they will lose potential customers.

Yeah same here. It seemed like the best mobile wallet to store altcoins.
Have you found some reliable alternatives for it? Because I found Coinomi after searching a lot.

This does not look good. This is the mobile wallet I use and this is what I recommend that everyone use. I know that there will always be vulnerabilities in any software but its the handling of the situation that had me peeved. I hope they fix it and behave more professionally next time.

You have Exodus which support multiple coins as well but they only work in Desktop for the moment and there is Jaxx which you probably heard of before but they also faced a hack in the past (I believe private keys are stored in their servers) but they support phones so It's up to you.

If we want to stay mobile, the best would it be then, to generate mind or paper wallets. We could maybe use coinomi only for transfers. Would that be a solution?

Thank you for this information, in fact I have never used a coinomi wallet, this information will be very helpful for those who use the coinomi wallet. I hope this problem can be resolved quickly so as not to harm the person who has trusted and used the coinomi wallet. Watch Out!

I would rather wait for the vulnerability to get fix by Coinomi instead of going to Jaxx which has history of hacks. Of course there is the ever reliable Electrum however, it only supports bitcoin though.


Yes, I have coinomi wallet and I'm pretty disappointed with the way they handle the issues. Although I only hold small amounts of altcoins in my wallet, but still this is a scary one seeing you address transmitted in plain text across the network.

Nah I don't want to use Jaxx, have heard about it before no point of switching to a wallet already with a history of hacks. Would check out exodus. Thanks.

What is so bad on the way, addresses are shown? As long as they son't publish the keys ....

I would not recommend a Desktop wallet built on Electron to anyone.If you know how electron works,their source code is installed on the desktop since it doesn't make any native apps and only runs an instance of a chrome browser on a windows PC.Code security is none,I don't even know how people trust such apps wit their private keys.

Don't.Exodus is equally prone to all those vulnerable hacks and certainly  doesn't belong in  the category of 'Safe Wallets'.

Oh I missed this news. Fortunately, the one on reddit is still there because the page on github have been taken down already. I've been using coinomi wallet for months now, tbh I used it yesterday for few transactions.

I visited their twitter page and saw that they will be giving their official statement about the issue in few days [LINK (https://mobile.twitter.com/CoinomiWallet/status/914143446964883456)]. I'll wait for that statement first, I hope we could see it soon. Bad move of blocking that person though.

Why? AFAIK Jaxx only major issue was the possibility of extraction of the seed that was stored decrypted. But keep in mind that even if that's a major issue, this can only be explored if someone got access to your phone and can break through your lock screen. While Coinomi will transmit all your Bitcoin addresses - not private keys or any critical information that may expose your coins to hackers - without any SSL.

While Exodus is still kinda safe. Any wallet may be an "unsafe" if you're not careful with your OS. Even while using Electrum, you may lose your coins if you have a malware on your computer.

Oh, that's very unprofessional PR. But as I understand, this is only privacy issue and our coins are safe, because only bitcoin adresses, not private keys broadcasted over the network. But it must be fixed.
Coinomi was my favourite wallet for Android, because they support many coins, not like Jaxx or Exodus. I hope this privacy issue will be fixed, because I don't see any good alternatives for Coinomi.

No they are putting the Jaxx hack out of context. It could be the person who reported it transferred his own funds to another wallet and claimed he has hacked. In fact the report was questionable because it was made right after the discovery that your Jaxx seeds could be extracted in plain text.

The private keys are not stored in their servers. Please read up on it before you post. Its easy.

Woah that just blew my mind. I had no idea man-in-the-middle attacks could even happen with bitcoin transactions! Holy crap this is like getting DDOSed right at the wrong moment to screw you over and steal your bitcoins.

Well this is not good news. I hope they get it fixed. Coinomi is where my first wallets am from, still have them too

i hope the dev will fix the problem so we can still using the wallet. its too bad to hear this news because i save the coins into coinomi and thank you for giving this info. i am trying to thinking to move my coins into another wallet if there is not any update from the dev. but i realize there is no guarantee for every wallet that will be 100% secure.

I don't know if this is an official response, but if it is... great that you've updated to SSL.  However, this has moved way beyond the SSL issue and is more about the response to the potential security issue.  You probably should huddle up as a leadership team and figure out how to recover the disaster your social team created.

We are going to make an official announcement as to what really happened here once our investigation is through, thank you.

Ok fair enough. You should make it official so that all this questions about the vulnerability of your wallet could be address. Its been what more than 2 weeks now since the report has been reported and we haven't seen any reply from you guys. You can't just go here and post:


I like Coinomi. But don't let this issue ruin your reputation. At least a official statement will be enough for your users and potential users. So the feeling of doubt about your services can be cleared.

Agreed. Until the issue is fix and has been confirmed by other users I will still not getting you wallet. A lot has been discussed about the issue not only here but it twitter sphere and reddit. A official statement coming from you guys will qualms all fears about your wallet. And please inform as well the individual who have found the vulnerability and let him do another testing run so that there's no doubt that the issues is fix already.

As I understood right, the issue is fixed now, isn't it or should we move our coins away from old addresses?

I don't think so. Doesn't look like Coinomi thinks this is a security issue - just like what happened with Jaxx a few months ago. They even changed the title of the issue from Security Vulnerability: Coinomi transmits all data in plain text to Coinomi transmits all data in plain text.

Was this ever resolved ?

just heard about coinomi and was wanting to try it out.

Oh, good that you made us aware, thanks for that. I was about to set up a wallet, but wont go this route now. Also I dont like this unprofessional behavior, they should be rather thankful to this developer because he made them aware of a security risk. I dont understand some people.

Yes I would also like to know if there have been any recent developments on this situation.

Looks like they fixed it. However they never admitted that this was an issue, so there was no official statement.

https://www.reddit.com/r/litecoin/comments/74ay4r/can_anyone_confirm_this_re_the_coinomi_ssl_issue/do0g5tf/

That's all Coinomi has said about the issue:
https://www.reddit.com/r/litecoin/comments/74ay4r/can_anyone_confirm_this_re_the_coinomi_ssl_issue/dnyre14/

Sooooo, as for February 2nd, what's the security status of Coinomi?
Can someone with a better technical knowledge can add sth. to this topic?

The Coinomi Phrase (the wallet private key) holds all your private keys from your used coins in the Coinomi wallet.

Normally a phrase or private key is stored in the blockchain of the coin in question. Sofar i know Coinomi has not his own blockchain, so are the Coinomi phrases stored on thier server?

Can anybody fill me in ???

Coinomi is a light-weight wallet so doesn't need to download the whole blockchain.
Your private key is not stored on their server. Your private keys never leave your device actually.

No. Your private-keys are generated based on your seed - which only you have. Nothing is ever sent to a server.

More: Coinomi is a Hierarchical Deterministic (HD) wallet. What excactly does that mean? (https://coinomi.freshdesk.com/support/solutions/articles/29000009705-coinomi-is-a-hierarchical-deterministic-hd-wallet-what-excactly-does-that-mean-)

Thank you so far. I almost got it. But the Coinomi seed is not particulair of 1 (coin) blockchain. Bip0032 says that the seed is translated trough the masternode.

Is the seed (phrase) of Coinomi a bundel of seeds of diffrent coins you are holding in your wallet? I mean Coinomi has no masterode, so where does the unfoulding/translating of the Coinomi seed take place if it contain several blockchain seeds/keys ???

Good question. I was also wondering about the seeds of the different coins. But seperate private keys of every  coin can be exported. I did that for example with ETH to import to myetherwallet.

I once imported my hardware wallet mnemonic phrase into coinomi wallet and it showed me the same BTC address as it was showing in hardware wallet app, same ethereum wallet as in app and same for doge addy as well.

From what I understand is that it loads wallet according to mnemonic phrase and does not contains any separate keys/seeds for each altcoin wallet. Its only that one mnemonic phrase.

Did you export private keys via Coinomi menu? It redirects to webpage... Is it safe or should I use air-gapped machine then?

I went through the steps, posted by coinomi.
https://coinomi.freshdesk.com/support/solutions/articles/29000009717-what-is-the-recovery-tool-and-how-do-i-export-my-private-keys-
As I remeber right I used airplain mode, because the mnemonic converter also works offline.

It's an open source project and you can run it locally in your PC without internet connection If you want to but since the website is forked and hosted by Coinomi, I see no reason on why you should use air gapped machine for that because If you're afraid of Coinomi, then the wallet itself is not open source, they could've stolen your funds already If they wanted to and the same thing applies to a hacker who have access to your phone through a malware.

@Coinomi DEVS Do you have an ETA for Callisto airdrop release? I use yobit too and already have my CLO.

This is not the ANN thread. I suggest checking Twitter for announcements or their Telegram, the CEO is pretty active there.

My coinomi wallet has anything coin however not recieving and saying no connection and not showing up on the blockchain .are these coins actuly in my wallet .and verify keeps going up like it still getting spproved ..Mmmmm

If you don't see the funds in your wallet after checking your address in a blockexplorer, then you don't have the funds. If you do, It could be a display issue.

Alternatively, I suggest getting in touch with the community/dev team in Reddit or Telegram, can be found on their site (footer): https://www.coinomi.com/

Bro almost 10 months and more up so far after you opened this thread! Still is that not confirmed from the dev team of Coinomi, they should check and rectify the bug on their wallet or site right?

Can you check and confirm once again. I have their application on my phone and so far I did not find any issues with the wallet about usages.

I also can't find any bugs (even on my second phone with old androin 4.4). Nothing disappeared, except the Ethereum tokens. Baught some within the Coinomi App (not the built in exchangers), but I forget about them, so that I can't find them. But also therefore exists a solution. Export Ethereum wallet to MEW and the tokens should be visable.

I'm not related to the team, I only made this thread as a warning. I suggest using their Telegram and asking them yourselves.

This is an old dBase issue (funds were not affected of course) which is now fixed. All tokens are addable from either +Tokens list (if they're natively listed in the wallet) or the search function in the same page if they are not.

Also note that you don't have to expose your ETH key to mew, as the seed is cross-importable (coinomi to mew, mew to coinomi).


Angelos from Coinomi