You can read all about the vulnerability here: https://bitcointalk.org/index.php?topic=5114708.0

If that's TL;DR; here's the short version:
It's not a backdoor, they used a library and didn't configure it properly, because of this the seed phrase was sent to google for spell-checking.
Eventough it was sent over SSL, somebody in google's HQ with access to the logs could easily parse them and find the unencrypted version of the seed.

There was a big discussion between coinomi and their victim, and in my opinion, coinomi took the low road... They defenately didn't handle the situation as they should have.

I would never touch coinomi with a  foot pole. Making mistakes is human, bugs happen, but the way they reacted made me have an instant dislike for their company.

If you're holding a lot of different altcoins, you might aswell go for a ledger or a trezor instead of meddeling with closed source wallets stored on your smartphone (do look at the list of altcoins they support out of the box... )

My daughter is in lockdown, as is the rest of our country. Her teacher sends over some homework from time to time, and she gets some extra assignments from my wife and myself.
However, she has significantly more free time now than she had before, so she got bored.

As a hobby, she started doing stop-motion animations... She's not really experienced (yet) so it's not that professional (also, she's 11 years old)... However, I do think they look funny.

So, in order to learn a bit about the crypto ecosystem (and earn some crypto pocket money), i created an account for her (MenMs => she loves M&M candies ) and she's taking non-offensive requests for stop-motion animations. She is a minor, so this thread is self-moderated, and all offensive replies will be deleted. I'm an advocate for free speach, but keep over the top vulgarity out of this thread please.

A sample:
https://www.mocacinno.com/videos/final_5e9701afb206350015357b1d_27372.mp4

If you want a stick figure doing an unboxing video of your product, a lego figurine spelling out your product's name, a playmobil doll dancing to your company's themesong, an original wedding invitation stop-motion video, a physical "bit"coin rolling over your screen as a screensaver... Post in this thread with the description and  reasonable compensation of her time. I'll let her pick which projects she accepts (so there is no guarantee she'll take a project, only when she's interested and has spare time).

Last but not least, she has her own account, I take financial responsability. If you send her funds, and she does not complete her project, i'll reimburse you in full. Since she's my daughter, I will not act as an escrow since i'm not unprejudiced. However, a trusted thirth party escrow is accepted.

There were some vulnerabilitys, if a governement agency controlls enough entry and exit nodes, they might be able to find you.
There were also some vulnerabilities in the tor browser, but they're usually patched pretty quick.

That being said: even for a governement agency, it's not as simple as parsing the logs from some of their nodes, decrypting the data, tracing the user, sending a courtorder to the isp and drag 100% of the culprits to jail. The whole process relies on luck, a user has to have a circuit where both the entry and exit node were owned by the same governement (and afaik, they use a reputation system), then the user has to send unencrypted data that proves he/she commited a felony, then the user should have used his home pc without VPN and he should be located in a jurisdiction where law enforcement could arrest him/her.

But let's not dig this deep, i think most governements don't care enough, nor have the technical knowhow to go after those ransomware providers. For god's sake, a company that works in the same branche as my company was attacked not so long ago, and they released details: the ransomware providers had a controll and command server hardcoded in their ransomware, they even had a helpdesk that could be reached by mail and phone... No need to go to the darkweb, they were working in plain sight, but still nobody was able to arrest them.

fixed that for you

username: mocacinno

i'm not really a gambler anymore, but i have placed some bets in the past, so i guess i'll be able to write up a decent review afterwards

Sooo, i've received the 5 bucks in order to test the site... Here's my review:

• The 5 bucks was credited swiftly, with thanks
• The site itself has a less than perfect reputation (as yahoo62278 already mentioned)
• The signup process was easy, i mean: everything in their gui was exactly where it needs to be, no supprises, no visual flaws
• Before being credited the 5 bucks, i already start up by reading the information, the game is not that hard to understand
• The operator might make it a bit easyer to get your hands on the seeds, this way it'll be easyer for the gambles to check provably fairness
• After receiving my 5 bucks, i played at very least 20 games, but since the "my bets" overview seems to be bugged, there was no way to verify***
• The game itself is addictive. It allows gamers to pick a strategy, calculate the odds and try to beat the odds. I tried with 2 bets simultanious: 1 autobet and autocashout at a low multiplier and one manual bet... I would let the multiplier increase depending on my current account balance... I ended up with a small amount over the 5 bucks i was initially given, but had lots of fun... At first sight it looks stupid, but after 2 or 3 bets you can't stop watching that cannon ball fly trough the sky.
• I was a little dissapointed that i had to enter personal information before the withdrawal was accepted***
• The design works, everything is easy to find.. However, there are some problems using my browser (chrome Version 78.0.3904.108 on windows 10, completely locked down): the chat window was hard to find and to open; there's an arrow pointing downwards on the top right hand of the screen (indicating there should be a menu) but it's impossible for me to click said arrow; after entering extra data in my profile, the link to the withdrawal page did not respond (had to go back to the main screen and go to the withdrawal page from there)
• The list of accepted currencies is very reasonable... I mean, if you don't have a wallet for any of those coins, you're probably not really into crypto (my personal opinion tough... But really, if you don't hold any BTC, LTC, ETC, DASH, DOGE or TRON, you should probably rethink your portfolio)
• So far, i haven't seen the LTC i withdrew, so i can't really comment on the speed or exchange rate received the LTC after less than 15 minutes (didn't really time it, but it was short). The exchangerate used for LTC was VERY fair... As a matter of fact, it was better than i'd hoped for.
• I would advise the company to move away from cloudflare's SSL certificate, as they work as a MITM. A letsencrypt x3 certificate is free, trusted and avoids any 3 letter agency snooping around...

Conclusion: it's a fun game, addictive, nice design... But, there's some work on showing the seeds to the clients, there's some work on the design flaws, they should not be using cloudflare's SSL, there's some work on the betting history and the company should defenatly try to regain a good community standing

***screenshots

To mine bitcoin... No...
There's a whole subforum dedicated to mining, but you should read the sticky post here: https://bitcointalk.org/index.php?topic=2415854.0

Basically, in order to mine bitcoin, you need:

• Knowledge
• Time
• Very cheap electricity
• A good plan
• Several thousands of dollars to invest in performant ASIC's, PSU's, racks, cooling, wiring,...

If you want to learn: read up using this forum, and the many online resources that are available for free. You can even buy a cheap (second hand) ASIC to learn how to mine (but you'll never break even). If you have learned at least the basics, help the community, maybe one day you'll be able to join a signature campaign and earn a couple of bucks by helping others.

If you have a decent GPU, you can see if you can mine some GPU-minable altcoins (not bitcoin tough) and exchange these altcoins for bitcoin

You can also see if you have talents that translate to online jobs (for example: designing, coding, art, translating...) and post your services in the service subforum.

I'd personally advise anybody to stay away from micro-earnings, bounty's, gambling, HYIP's, ponzi's, refferal link posting, browser mining,... You either pollute the community, get scammed or earn (allmost) nothing

Well, they have a bittrust page that's filled with (what looks like) fake reviews:

http://bittrust.org/bitcoinmixorg

The script at the bottom looks like they're boasting with mixes that are currently finished... Bad idear, i wouldn't want to use a mixer that'll tell the whole world that at that precise moment 0.11 BTC was mixed. If somebody would start checking the current mempool/new block they'd have a starting point at breaking this mixer's anonimity.

It seems like it once had a support thread here on bitcointalk:

https://bitcointalk.org/index.php?topic=2413192.0

Doesn't seem to positive either.... The discussion defenatly floats towards "fishy"

Even if you put all the nontechnical red flags aside, they use cloudflare as a MITM. So even IF their bittrust page looked legit (which is doesn't) and IF their service thread looked positive (which it doesn't) i'd still not use this mixer.

no, mixers are an important part of the crypto ecosystem. They protect me against a $5 wrench attack.
I mix and/or coinjoin allmost all funds i get. I don't want anybody to know how much crypto assets i hold, so if i'm ever doxxed, criminals won't enter my house and demand my private keys... Tip: I don't hold a lot of crypto assets...

Privacy is a human right, and since most "normal" crypto currencies lack a good privacy, a privacy enhancing service should be legal.

You are right tough, most mixers operate completely anonymous so they don't get subpoena's from any law enforcement agency. They're simply not registered businesses. Some are even 100% without a clearnet mirror (only accessible over tor)

bitcoin is indeed pseudo-anonymous. If a hacker is payed in bitcoin, about anybody with enough time and willpower would be able to follow the trail of unspent outputs used as input for new transactions.
If the trail would end with a hotwallet belonging to an exchange (or any KYC service), it would take a 3 letter agency just a small amount of time to get the name of whoever exchanged the BTC for fiat.

However, there are tons of ways to break the link... Mixers and coinjoin for example, or exchaning to a high anonimity coin like monero and back to BTC.

The bottom line is: with "normal" coins like bitcoin, litecoin, ETH,... A competent hacker is able to break the link between the stolen funds and the addresses finally holding the stolen funds. An incompetent hacker should get caught (altough i doubt law enforcement has enough knowledge, willpower and time to try to track all funds aquired by illegal activity, so i think even incompetent hackers will get away with their crime most of the time... But that's just my gut feeling after reading the understaffing/underfunding/incompetence of law enforcement in the newspaper).

https://github.com/JeanLucPons/VanitySearch

A vanitygen program like this one (GPU) can create up to ~200.000.000 private keys => addresses per second.

https://bitcointalk.org/index.php?topic=24268.msg41803506#msg41803506

the address space is 2^160

This means it would take your gpu
23171956451847141650870193314249 years to generate all private key => addresses

Since the sun will exist
11000000000 years,
It'll take about 21.065.414.956.224.674.228.063 suns to scan the keyspace.

Even if you want to scan only 1% (so you have a 1% chance of finding a funded address'es private key) and you own 1 million GPU's, it'll still take the lifetime of 210654149562246 suns

So, yes, i'd call those odds close to 0

Things change when you use a flawed RNG.

Well... a bech32 address is basically a hash of the public key that's derived from the private key.

So, if you find a private key where the hash of the public key is equal to an address that was previously funded, you'll be able to spend the funds funding said address EVEN if the funds don't actually "belong" to you.

What you are talking about is key collision... It's theoretically possible, however, the odds are sooooooooo small, they're so close to 0 that in reality you can assume key collision is impossible IF the private key was generated properly.

In other words: it's not like you're "receiving" an address from a central institution, and if this institution runs out of addresses to pass out there'll be problems. The correct situation is:

• your wallet generates a completely random private key (or it derives a private key from a master private key)
• your wallet derives the public key from the private key
• your wallet hashes the public key and the endresult is your address

Here's an interesting read as to how bech32 addresses are generated: https://bitcointalk.org/index.php?topic=4992632.0

Looks sleek, however, i'm not really a fan of proprietary connectors.

Will you be testing this unit by actually funding addresses generated by this wallet? It does seem like their firmware is open source but it looks like they've actually just modified trezor's firmware: https://github.com/bithd

I see you're testing sending and receiving, maybe it's interesting for you to look at the testnet?

Most wallets have testnet versions (altough i'm not completely sure electrum for android has one; electrum for desktop defenately does), and there are free testnet faucets (i'm actually running one myself). That way you can test with the testnet version of your real wallet, using worthless tBTC and you won't even bloat the mainnet blockchain... Just my 2 satoshi's tough...

Well, it's $95 + PSU + shipping & handling + custom duty + tax

It draws about ~1600 Watt at the wall and hashes at 16 Th/s. If you think you can ROI with those numbers, why not...

Do realise that with this ASIC, even if you pay the (low) electricity price of $0.1/Kwh, you'll have a daily income of ~0.00027341 BTC =~ $2 (at current preev rate) while your electricity cost will be close to $4.

So, even if you only pay 10 cents/kwh (i pay close to 30 cents), you'll make a negative profit of $2/day... And we're close to the halving aswell, at which point you'll probably see your "profits" going even further into the red.

If you see it as a learning experience tough, why not...

There seems to be quite a discussion about them on reddit, the consensus seems to be that they're a scam...

https://www.reddit.com/r/Bitcoin/comments/fxelq6/beware_bithull_miner_scam/

About which ASIC to buy, you can start by having a look at this thread:
https://bitcointalk.org/index.php?topic=5045732.0

However, before you commit to buying an ASIC, please be aware that an ASIC is NOT a free money press!
Bitcoin mining has become a very serious business, one with very thin margins. If you buy an ASIC and you haven't done your homework, you might end up losing money (no matter how good and performant your ASIC is)

I haven't mined in a really long time, but i've never heared about an "BH-FGPA-Miner"

Bitmain is going to produce sha256d ASIC units that hash a ~110 Th/s

At the moment, they produce units that hash around ~70 Th/s and cost ~$1600

However, these are ASIC's, not FGPA's. An FGPA is not as performant as an ASIC.

I'm not saying that you're being scammed, altough my gut feeling tells me these numbers are not OK... An FGPA that'll create sha256d hashes @ 360 Th/s sound unbelievable to me... But maybe i'm wrong, eventough i don't think so...

Any links to the product page?

That's just a textbook example of ban evasion... Which is a bannable offence.

It's you, as a person, who is banned, not your account...

I would suggest to read all the rules, but i guess it's to late now (since you are banned): https://bitcointalk.org/index.php?topic=703657.0

Here's an interesting read:

https://www.nejm.org/doi/full/10.1056/NEJMc2004973?query=featured_home

Like I said before, 72 hours should be sufficient. It's true that if loads of viable virus particles are placed on the most habitable surfaces and they are stored in the "best" way, virus particles can be found much longer than 72 hours... But those are lab conditions: an abundance of "fresh" viable particles, selected surfaces, ideal conditions. And even then, only a very small amount of virus particles are still more or less viable.

There is something else coming into play: the viral load... I've seen studies that HIV infected woman can have up to 900 hiv virus particles per ml of breast milk, but still allmost no babies get infected and become HIV positive after drinking the milk... Because the load is low. Your immune system comes into contact with potentially deadly viruses and bacteria on a daily basis. But as long as the load isn't to high, it'll deal with those pathogens.

Same here... If you wait 72 hours, the viral load on your package should be so low that you're basically in the clear. Especially because corona viruses die faster on cardboard (the box should be cardboard) and hopefully the goods inside of the box (plastic, stainless steel) were not touched for a longer time (how big are the odds somebody infected inserted the ASIC in the box and sent it out the same day).

Now, once again, i'm not a doctor, I haven't touched this stuff since college 20 years ago... Not that much studies have been carried out, and the ones that did weren't always conclusive. Even the ones that were conclusive sometimes came to different recommandations. But I wouldn't worry about it. Sure, if you want to be 100% sure you can always wait 2 weeks, but after reading up, i do think 72 hours should be more than sufficient to decrease the viable virus load to a level where any normal immune system should be able to kill the remaining virus particles.

This is not a promise tough... If it were me, i'd just wait 24-48 hours, but if you want to be sure, you should wait 72 hours, wair a tivec suit, gloves, mask,..., desinfect with chlorine,...

That's really enough to wipe the bitcoin libraries and binaries off of your system. However, the DATA still remains, per default in ~/.bitcoin . As i've said before, even if you no longer want bitcoin binaries on your system, it's still a good idear to backup ~/.bitcoin/wallet.dat (unless you've created a different wallet or changed your path).

ChuckBuck already answered this, but here's a screenshot...


In case this screenshot isn't showing you... There's also the screenshot you, yourself have posted: https://imgur.com/a/ET0nCML => this also very clearly shows yesterday's timestamp on the withdrawal request.

Today is Wednesday the 8th of April, so Tuesday the 7th of april was yesterday... Hence you had this conversation only yesterday. Freewallet is not a wallet, and their support is not fast... But if you jump trough their hoops you'll have a decent chance of getting your funds unlocked.

Don't get me wrong: i'm not a fan of them, i think they misbrand their exchange and mislead people into thinking they're a wallet. I don't like the fact that they do not disclose on which grounds they freeze accounts. I don't like the fact that they're slow in their actions after freezing an account... I would never use them, I would never recommand them, but most cases do seem to resolve eventually.