Mnemonic is no longer safe?

[Zhi Wei]

Just want to share, I can't prove that mnemonic safe or not.  I'm not an expert for things like that.

My friend just got hacked, lost about 300-400 USD.

He wonder how it happened, make some probably the device was infiltrated by malware, if yes. All his key is gone(all), so there's no only 1.

He was generated Mnemonic by coin98. Never connected to MetaMask or some things like login to connected, never.

Address land to "0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82"

0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82 has lot network. There's 5 I found. https://blockscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

ETH  https://etherscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
BSC  https://bscscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
Poly https://polygonscan.com/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
OP https://optimistic.etherscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82
ARBI https://arbiscan.io/address/0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

Take a sample :

Code:

	Txn Hash	Age	From		To	Value	Token
0x3cf166bd6c86b610162daa81f1cbc3dba78383fdd6399eac3091f1e1266158e6	1 hr 21 mins ago	0x46db46fca91287acada4669788ea0e0e6fccc4d6	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1,000	DEXTools (DEXT)
0x12449d639d36ff5360bf2ef507175ac0d2d7ee4b28397f0841d7b7760fe9cd00	1 hr 21 mins ago	0x46db46fca91287acada4669788ea0e0e6fccc4d6	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.124008	Wrapped Ethe... (WETH)
0xe11c041c8a3a34cb4c3127ef16c9ac42c144d76a825c962998187634d13cbae3	1 hr 33 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.02358337	Governance O... (gOHM)
0x1f56d27daaf2eb9ea62a34488a52ba1290f67c5c69bff3e1470a20466861a031	1 hr 34 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	16.55468149	Ethereum Nam... (ENS)
0xec5390bed60aec9deeea96e9518b20b21959a1e5a03eaf983008616656357ce1	1 hr 34 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.5	Wrapped Ethe... (WETH)
0x4486b49d823e35d72194cfb1103dff731d917ecc302e0c39f1feced1d0cad3df	1 hr 35 mins ago	ENS Name sircryptoofblock.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	166.78365256	StargateToke... (STG)
0xd80d62c04f17f25d7481acfc2b10e7358337751580991b26031083386ee2ee37	1 hr 54 mins ago	0xea1256ad1cc8144c09aebe19217daedc2fb6c655	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.09542125	Wrapped Ethe... (WETH)
0xf3bb3f7954b5b85bb4d9dd3d691d72fd1eb8cc18be23c55440bbb52a31fa87bb	1 hr 59 mins ago	0xea1256ad1cc8144c09aebe19217daedc2fb6c655	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	3,325,000	 ERC-20: Met.....yAi
0xd9c4a28c70c551b251876cfa94d0d66181a925f1fd5e75b550ea547ecfd412a1	2 hrs 1 min ago	0x3e99ef9745c7174ef20639b1035b79ed1b8a085e	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	250	Polkastarter... (POLS)
0x19a9516e5dfc3695edfdba696ae2b6527f9384e7e286acd48569a9cd6242eae3	2 hrs 5 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.507535	Wrapped Ethe... (WETH)
0xda35ffcb30ebe56c4e3e5303170dfc12ab313bdf653c8b4c4752aecd37d3019d	2 hrs 10 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.54064217	Wrapped Ethe... (WETH)
0x94d3ad9ea80dc5df577fa37f25383e049aa98f76715f8df922ad8b51b4bd7663	2 hrs 17 mins ago	ENS Name dmuz.eth	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	1.8296811	Wrapped Ethe... (WETH)
0xef4e4413bb3535c78bce921f9d05814961c3a9b14aa3ace872ac51de20e80644	2 hrs 37 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	41.99255724	Olympus (OHM)
0xf0b29887ad526399f291462a4b3eef4283001037a3547f5c030b59ccb52fd00a	2 hrs 38 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	92,976,341,396.66919415	The People’s... (PEEPS)
0xa752e2a30cfdc25107013f9ea2338f2b0eb55ac423762c8a614a08fe6c9d8188	2 hrs 44 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	3,810,550,290,956.5476974	Bezoge Earth (BEZOGE)
0x7039964c4e99532c75aada210d1d81d7231bc49d7fe268fff4a69d3711e1fdb2	2 hrs 44 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	41,267.59937671	MintySwap (MINTYS)
0x08aed967fba449b94e5ff4536fba07d25f8ae1a67ff956781dd1e1aedea81bdc	2 hrs 45 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	49,999.99999716	Falcon 9 (F9)
0xa2223addbef9999d87140a013e751b443bbdde4d459ed6b345b6d925e92aa81e	2 hrs 45 mins ago	0x154eff17af3ae2fe2064fe70fb997d807cf1c011	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	80,462.26	ACCEL (ACCEL)
0xd012dc1d82c7f8cb602a0e1b9d4b0295691431b4aac90c6e5ef0e497e2432769	2 hrs 57 mins ago	0x8090b15679d7b67625f5655883a7e42fad1adffa	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.22792	Wrapped Ethe... (WETH)
0xd33bb3f40d8ad5158c5798ea0cf5ea680779a18ee3bf7b7e4f11018ffdb948a0	3 hrs 2 mins ago	0xe9c14ea0d6e9aaa7c58774b05cc6f455cc506bda	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	246.6231	Ultra Token (UOS)
0x56909ca1b3b820959a45daa3792c7002d7786be28821b0f3c32e006761ce4de4	3 hrs 5 mins ago	0x92a3d57a912488665946646c123b0c5d3722ea8c	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	501.793375	Litentry (LIT)
0xfbd778310d2b08c183a564de912355cf6c923b27e2fa4bd5cbc17be0ae101fc7	3 hrs 6 mins ago	0x92a3d57a912488665946646c123b0c5d3722ea8c	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	413.79544305	StaFi (FIS)
0x75f905d63f8725364e6feb94d2502e0f98b0890e4fa816a8db3dc838d7d92f08	3 hrs 9 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	15,136.99488655	LooksRare To... (LOOKS)
0x5f4ec7cd2719489b1153f84c72ffca0d4e152945d4848c8f0a2eabc61f8c257b	3 hrs 10 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	7.92	Staked Aave (stkAAV...)
0x1b76784ae516a45d3cd0d73b81e5235b9c32aedc7f84f8290700887050e8810a	3 hrs 12 mins ago	0x33a54fd3dbe912d7725962d216970ec1189321c0	 IN 	0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82	0.22316481	Wrapped Ethe... (WETH)

All those sender is sending all assets to 0x89e7d7b622fe0dcc53c42cee12a9ebdc9fa29c82

I been research possibility:

I mean theres tons of addresses out there so its like how could you not hit one

Because there are this many possible valid 12 word seeds:
340,282,366,920,938,463,463,374,607,431,768,211,456

Like I said I'm not an expert, just want to share. make this thread as archive in case there solved or new case found.

[1715119766]

1715119766

[1715119766]

1715119766

[1715119766]

1715119766

[MAAManda]

As far as I use Non-Custodial Wallet, I think Mnemonic Phrase is very safe, I've never experienced any hacking either. BTW I use Trust Wallet. Coin98 has high credibility, they are on par with other Non-Custodial Wallets such as Trust Wallet, imToken and others. So I don't think the problem is coming from there.

I don't know for sure why your friend's wallet got hacked, but I think it has something to do with interacting with a fraudulent smart contract. Your friend may admit that she's never done that, but who knows?

For this problem I only have a suggestion not to use the wallet anymore, or to make sure that your friend's wallet is not connected to a project, you can check it at https://revoke.cash/, hope it helps.

[Mr. Magkaisa]

-  In my current experience, I don't see any problem with this. Why did @OP have such a bad experience with this? Because for me it's safe as

long as you keep your mnemonic in the right and safe place. Just make sure that when you use it, don't ever forget to log out of the platform

wallet you'll be using so that hackers can't access you.

[vv181]

I never heard of Coin98 Wallet, and upon checking it out, it seems there is no source code available. Its availability is also only on Chrome.

Mnemonic code generation by a popular and trusted wallet is fine. The seed generation process is secure as it widely can be viewed by those who understand. Until this time, A popular wallet user is safe from any mnemonic code vulnerability that I'm aware of.

The possibility of your friend getting hacked due to personal security issues is more likely than a standard process of mnemonic code generation and potential collision. So without knowing your friend's digital hygiene, it is hard to seek the actual reason for it getting hacked.

[JustEducated]

The seed phrase is still pretty much safe AFAIK.
Maybe your friend made and error unknowingly to him or maybe his device was infected by malware.
And again your should have chosen a popular and more safe wallet rather than going for an unknown wallet IMO.

[Crypt0Gore]

As far as I use Non-Custodial Wallet, I think Mnemonic Phrase is very safe, I've never experienced any hacking either. BTW I use Trust Wallet. Coin98 has high credibility, they are on par with other Non-Custodial Wallets such as Trust Wallet, imToken and others. So I don't think the problem is coming from there.

I don't know for sure why your friend's wallet got hacked, but I think it has something to do with interacting with a fraudulent smart contract. Your friend may admit that she's never done that, but who knows?

For this problem I only have a suggestion not to use the wallet anymore, or to make sure that your friend's wallet is not connected to a project, you can check it at https://revoke.cash/, hope it helps.

I have heard about this Revoke.Cash but I don't know how safe the website is, have you used this yourself? Is it safe for any wallet users to connect to? Seed phrases are safer offline, maybe his friend copied the Seed phrase online, in mail or in PDF, I've seen people keeping their seed phrases in the most stupid places.

[Tytanowy Janusz]

Its not that Mnemonic is no longer safe. Everything is as safe as the weakest link. If his device was compromised or someone had access to it without his knowledge than even 100% buletproof solution will not work. My guess is that mnemonic did not fail. your friend failed to protect it.

[Jackl87]

Just want to share, I can't prove that mnemonic safe or not.  I'm not an expert for things like that.
My friend just got hacked, lost about 300-400 USD.
He wonder how it happened, make some probably the device was infiltrated by malware, if yes. All his key is gone(all), so there's no only 1.
He was generated Mnemonic by coin98. Never connected to MetaMask or some things like login to connected, never.

Usually i think that Mnemoic phrases are very safe. I don't really know the numbers but as far as i know it is almost impossible to brute force the because there are millions of possible solutions obviously. So i would guess the reason why your friend was hacked was not the mnemonic phrase but the way he created it or how he saved or stored it. Usually you are connected to the internet when you are creating your mnemonic phrase no matter if you are creating it for metamask or for a desktop wallet. So if your PC is already infected with a malware or something when you are doing that they can already get the phrase there.

[Tony116]

As far as I use Non-Custodial Wallet, I think Mnemonic Phrase is very safe, I've never experienced any hacking either. BTW I use Trust Wallet. Coin98 has high credibility, they are on par with other Non-Custodial Wallets such as Trust Wallet, imToken and others. So I don't think the problem is coming from there.

I don't know for sure why your friend's wallet got hacked, but I think it has something to do with interacting with a fraudulent smart contract. Your friend may admit that she's never done that, but who knows?

For this problem I only have a suggestion not to use the wallet anymore, or to make sure that your friend's wallet is not connected to a project, you can check it at https://revoke.cash/, hope it helps.

I have heard about this Revoke.Cash but I don't know how safe the website is, have you used this yourself? Is it safe for any wallet users to connect to? Seed phrases are safer offline, maybe his friend copied the Seed phrase online, in mail or in PDF, I've seen people keeping their seed phrases in the most stupid places.

It's safe, I haven't used through this site but I'm still using a similar one. https://app.unrekt.net/
It helps us to completely disconnect as well as cancel any fiduciary rights to the websites we have ever connected to the wallet. I think this is also the cause that his friend had, leading to the above hack.

I am also using C98 wallet and I have never had any problem from it, C98 is a wallet as well as a non-custodial wallet developed by coin98 team from Vietnam. OP you can contact the c98 team directly to clarify the problem they are very enthusiastic about customer support, maybe you will find the reason you are looking for.

[Dave1]

For me it's safe, the thing is that how to back it up?

And maybe that's how hackers were able to get everything from your friend, did he write down his mnemonic phrase?

So it's really up to the individual safe practice, just don't safe it in the same machine, write it down just like old fashion, never put it online like in a cloud or something.

[Questat]

Mnemonic and private keys - perhaps they are safe as long as you know how to keep safe of these things. But if you just keep this on your computer, and save it online, I could imagine that it was easy to trace and lead to the cracking of your account. Well, I was not sure how you keep that and in your friend but most scenarios that lead to this are because we are practicing the wrong way of keeping them until we realized that our wallet has been accessed by an unauthorized person.

[OcTradism]

Mnemonic seed or private key itself is not harmful but you must use a clean device when you use a wallet to generate wallet seed or private key or when you import it.

Because if your device is infected, what you are typing will be caught and hackers can see your wallet seed or private key. Therefore they will be able to access your wallet and when they have access, they will still your coins and tokens.

It is why people recommend to generate wallet offline and use an airgapped device to store your wallet and coin.

Don't have bad web surfing activities and use antivirus, Internet security softwares. Prevention is better than cure and it is a best practice to avoid wallet hack.
Good topics on security and privacy

[MAAManda]

I have heard about this Revoke.Cash but I don't know how safe the website is, have you used this yourself? Is it safe for any wallet users to connect to? Seed phrases are safer offline, maybe his friend copied the Seed phrase online, in mail or in PDF, I've seen people keeping their seed phrases in the most stupid places.

Revoke.cash is very safe to use, you don't have to worry about anything happening to your wallet, instead by using Revoke.cash, you know where your wallet is connected. About Phrases, it will indeed be safer if it is stored online. I personally made a copy of it on a piece of paper and kept it in the closet, so I don't have to worry about hacking phrases. It makes sense that the OP's friend's wallet would be hacked if the OP's friend saved it online and maybe the file was accessed by hackers.

[KaliLinux]

as far as i use wallet mnemonic though no hacking happened. but the vigilance and care of the wallet must really be considered. What I do is often change the wallet if the wallet is used for airdrop transactions because it is so easy for hackers to get our wallet data by sending dusting tokens. but without the information experienced by a friend, I think it is an unnatural thing. did he make a mistake he wasn't aware of?

This is why it is advisable to use a different wallet for Airdrops if you are the type that participates in airdrops however, I too don't think Mnemonic is that easy to break if you did not place them carelessly. Safeguarding your login information can not be overemphasized and connecting your wallet to every site is not advisable too, I would normally write down all my Info in different Dairies and have soft copies of them too, and these devices I never connect to the internet.

[jossiel]

@OP, about the addresses, there could really be the same addresses that are being supported in differet networks or chains just as what you've posted.

And about your friend being hacked, let's say that there's something to do with the wallet especially if it's unknown and the developers of it are saving those keys and gains access to their users.

But a reputable one doesn't have that control to all of their users. I'm guessing that this is another fault of the user for which your friend has been a victim of phishing or has downloaded a malware.

[so98nn]

This is as much Safe as I was not able to access my own ledger when I lost it and also had the memonic phrases written perfectly on paper yet I was not able to access my coins. Somehow I found Back my ledger and then was able to access it, obviously the first thing I did was to reset and took entire back up of it.

Now if being owner of that I went through all that trouble, just imagine how hard it could be for someone third party to hack into someone’s non custodial wallet and gain access. Seems impossible. It’s safe for me.

[BIT-BENDER]

Coin98 is actually a non custodian wallet, although never used it so I have depressed idea of how it work. But from my experiences I think to hack cases can happen without any loopholes created by the hackers victims (in this case your friend was the victim).

I don't know the popularity of coin98 and this just makes me wonder about its own safety too. I have used electrum for a while now and since I kept my mnemonic key/ seed phrase safe I really haven't had any issues I believe the security behind it is impenetrable except their are so vulnerable actions on my path.

[Silberman]

The seed phrase is still pretty much safe AFAIK.
Maybe your friend made and error unknowingly to him or maybe his device was infected by malware.
And again your should have chosen a popular and more safe wallet rather than going for an unknown wallet IMO.

This seems like the most likely option, people are not really as careful as they believe when they are surfing the web and it is possible the friend of the OP installed an application which is monitoring his actions and extracted enough information for that money to be stolen, so the best thing that can be done now is to not use that computer anymore, backup your seed words and then make a fresh install and once that is done then generate new addresses with another set of seed words and move whatever coins are left there.

[cryptomaniac_xxx]

My best advise is for your friend not to used that machine or PC, it could have been ridden by malware already that is monitoring his wallet, a keylogger malware.

If he can format it better to that, just to make sure that the malware is deleted but he has to scan everything to make sure that it is clean.

I'm sorry for your friends lost, although it is not huge money, but I know it's hard earn and hopefully he will still invest and make profits down the line to recover that $500.

[milewilda]

When we do talk about mnemonic phrases then based up on experience and hopefully i wont really be able to experience loss of funds.
After a long years of using up my MyEtherwallet (MEW) and Electrum which is really that based on having those phrases
which my assets are still intact or havent lost because i had stored up offline those keys and not into my pc or cloud storage or something like that.

Safety of your assets would be definitely be depending on you.You might believe that you hadnt missed out something
but its impossible that a certain wallet could be bruteforce without knowing those words.
Those are been exposed.