Coinomi wallet hacked, all funds stolen

[Ben Barubal]

The wallet was drained on Feb 14th.  The password was in my head not on paper.  The seed phrase was on paper in a safe which only I have access to.  Coinomi denies all responsibility and basically says too bad so sad.  My wife and I are retired, the wallet held our "safe" retirement cash savings.  Stay away from this wallet. 

   What was your issue with coinomi? apart from the fact that your assets were drained on February 14 2023? You didn't recover it? have you reported this to coinomi support? As far as I know, this coinomi has been around for a long time.

     But I think there are a lot of people complaining here at coinomi because last year there were a lot of people who used this app and most of them didn't get their assets out and others made deposits but what they deposited didn't arrive at the address they gave. And the other is that the support does not even care about the concern issues of its users.

[1715650845]

1715650845

[1715650845]

1715650845

[DaveF]

Don't store any cryptocurrency on Windows. Not even Linux if it is running inside a Windows host.

How about this instead:

Don't store any cryptocurrency that you cannot afford to loose on Windows ANY DEVICE CONNECTED TO THE INTERNET WITHOUT A HARDWARE WALLET. Not even Linux if it is running inside a Windows host is secure against everything and if you do something wrong because you were not fully paying attention since you have done it a hundred times before, no matter how secure you think you are your crypto is gone.

Telling people to use this OS vs that may help in the desktop environment, but it still comes down to the user.

If you are not familiar with linux / windows / mac OS an older un-patched un-secured version of an OS you know may actually be more secure then one you don't since you are not trying to figure something out while trying to move money around.

-Dave

[gunhell16]

Based on what I discovered here at coinomi, although it has been around for a long time in the crypto space, it seems that there have been many issues with these wallet apps that have not solved the problems of their users.

According to the Trustpilot review, the latest negative feedback here was only last February 2023, and even every month of the last year 2022, coinomi has issues with its users from January to December, no issues have been resolved and those that are not beautiful and can be a reason for anyone to stop using it in this community.

Coinomi Unresolved issues

[taufik123]

Why are people with thousands of dollars in cryptocurrency still chasing airdrops that will only give you $5 dollars. Is it really worth the risk (let alone the gigantic waste of time it is)?

If you ask why are people with thousands of dollars in cryptocurrency still chasing airdrops? The answer is of course because some airdrops provide sizable incentives. Airdrops don't just do tasks share, like and fill out assignments and get a $5 reward.

Currently, some of the airdrops are quite hidden, those who try Tesnet on a new network, try a new platform, and make some transactions have a chance to get an airdrop for early adopters. We all already know about the UNISWAP, 1INCH, ENS airdrops, and several new airdrops for NFT users, namely BLUR, they get thousands or even hundreds of thousands of dollars from the airdrop.

For those who don't understand how to get the jackpot on multiple airdrops it might seem like a waste of time, but they do some research first. Because many of my friends (including me) get several airdrops that can replace all the gas fees used for conducting trials etc.

Don't store any cryptocurrency on Windows. Not even Linux if it is running inside a Windows host.

I keep some assets in Electrum Windows and it's still safe, as long as users can keep themselves safe and use premium antivirus protection.
I also use Hardware Wallet as the main storage and it is not connected to other devices.

[Lucius]

I keep some assets in Electrum Windows and it's still safe, as long as users can keep themselves safe and use premium antivirus protection.

I probably have some coins in old Electrum wallets, but regardless of caution and premium AV protection and the fact that I do not use the computer for any risky activities, I would still not recommend anyone who has a choice to keep more than what they are ready to lose in any hot wallet. We are aware of some dangers such as clipboard malware or fake wallets, but the bad guys who try to steal our coins never sleep and we can never know when they will find some vulnerability in Windows OS or Electrum itself.

[Pmalek]

A lot of more information could have been added to the OP.

- Was it Coinomi mobile or the desktop version?
- What activities is the device with the wallet used for?
- You said you were retired. Can we assume you are +60? How good are you with general online security, and do you know how to protect yourself?

But did you keep your seed phrase in a safe location, how sure are you that only you have access to it.

The questions were already answered in the OP. He/she said that the seed is kept in a safe and only OP can access it.

My advice is that you should create a new wallet and this time use a much stronger password.

I hope you don't mean a new wallet on Coinomi. I wouldn't use any software wallet for money I consider my "retirement funds". Go for a quality hardware wallet or an airgapped system. Sadly, it's too late to do anything about it for OP regarding the coins that disappeared.

and Electrum is the answer, more secure and free and Open Source.

That depends on how you use it. The mobile app or Electrum on desktop as hot wallet are still vulnerable software wallets. Its open-source nature isn't going to protect you from getting hacked if you make a serious mistake. However, Electrum as a cold wallet is one of the best options there are.

[taufik123]

I probably have some coins in old Electrum wallets, but regardless of caution and premium AV protection and the fact that I do not use the computer for any risky activities, I would still not recommend anyone who has a choice to keep more than what they are ready to lose in any hot wallet. We are aware of some dangers such as clipboard malware or fake wallets, but the bad guys who try to steal our coins never sleep and we can never know when they will find some vulnerability in Windows OS or Electrum itself.

The danger of malware is always lurking when the device is used for activities on the internet.
But for the use of the electrum wallet on the device that I use, it is only a second wallet or wallet to receive payments from signature campaigns and some other payments, not a main wallet.

I am aware that Electrum's vulnerability also depends on how we use the device.
I also always separate the Seed wallet from the device used and the storage I use for Offline seeds is not connected to any internet and also in physical form.

[doomloop]

The wallet was drained on Feb 14th.  The password was in my head not on paper.  The seed phrase was on paper in a safe which only I have access to.  Coinomi denies all responsibility and basically says too bad so sad.  My wife and I are retired, the wallet held our "safe" retirement cash savings.  Stay away from this wallet. 

I'm sorry to hear about your loss, I can understand how stressful and saddening that can be.

Regarding Coinomi, it's not uncommon for wallet providers to disclaim responsibility for lost funds, especially if the funds were not stolen due to a flaw in the wallet software or the company's infrastructure. So what they said is all they can do actually.

You need to always do your due diligence and research a wallet provider before trusting them with your funds. Look for wallets that have a proven track record of security and have been audited by third-party security experts. Also, consider using hardware wallets, which are generally considered to be more secure than software wallets, as they store your private keys offline.

[bettercrypto]

The wallet was drained on Feb 14th.  The password was in my head not on paper.  The seed phrase was on paper in a safe which only I have access to.  Coinomi denies all responsibility and basically says too bad so sad.  My wife and I are retired, the wallet held our "safe" retirement cash savings.  Stay away from this wallet. 

It's sad what happened to you, as everything in your coinomi wallet was drained? How long have you been using that wallet? Are you new to coinomi?

      in that situation, it's a bit stressful on your part, since you're retired, that means you're old enough, I hope you're okay after things like that happen to you, I also hope that if you save crypto, it's good to just buy a hardware wallet or use you of Electrum wallet.

[pooya87]

Regarding Coinomi, it's not uncommon for wallet providers to disclaim responsibility for lost funds, especially if the funds were not stolen due to a flaw in the wallet software or the company's infrastructure. So what they said is all they can do actually.

That only works for open source software that is released under certain licenses such as MIT that ensures the developers aren't liable for any "damages". But for a closed source software that we can't even verify where the vulnerability was that led to the loss, it should not work although the companies behind them will make it work.

[DaveF]

Regarding Coinomi, it's not uncommon for wallet providers to disclaim responsibility for lost funds, especially if the funds were not stolen due to a flaw in the wallet software or the company's infrastructure. So what they said is all they can do actually.

That only works for open source software that is released under certain licenses such as MIT that ensures the developers aren't liable for any "damages". But for a closed source software that we can't even verify where the vulnerability was that led to the loss, it should not work although the companies behind them will make it work.

Actually it's in the ToS that nobody reads. And stated a few other times & places. More or less it boils down to 'we are not responsible for anything' and although not with Coinomi specifically similar ToS it have made it though the courts in a few places and so long as it was not hidden and mentioned several times it's been upheld. Nobody is making you closed source software with an iffy reputation. Nobody is making you not use a hardware wallet / multisig wallet. Nobody is forcing you to store your funds in a hot wallet. And so on.

Perhaps a bit harsh, but in the end it's what it comes down to.

-Dave

[virasog]

Coinomi is a close-source wallet and we don't know how the keys are generated and whether they have access to users keys or not.
Take note that this doesn't mean they have definitely stolen you fund. There can be many other reasons.

1. It's possible that you used a weak password and someone was able to brute-force it.
2. It's possible that someone had access to your seed phrase.
3. It's possible that your device was compromised.

Even if they have stolen your fund, it's still your own fault. Because you used a close-source wallet.

Do you think coinomi themselves stole these funds because it is closed source and they can get access to keys or anything ?

The coinomi wallet is being used by so many people and they have a name in the market. They would not stole people funds, as if they do, they will have a bad reputation and people will stop using this wallet.

Another argument can be that they stole from this one wallet which may have contain billion or trilions of dollars, i don't think anyone's retirement saving can be something so big that coinomi decided to scam. I guess there may be fault at the OP end which made him lose all his money.

[Agbe]

The wallet was drained on Feb 14th.  The password was in my head not on paper.  The seed phrase was on paper in a safe which only I have access to.  Coinomi denies all responsibility and basically says too bad so sad.  My wife and I are retired, the wallet held our "safe" retirement cash savings.  Stay away from this wallet. 

Op did you login your wallet in another person's device which you forgot to logout? Even though coinomi is a close source wallet I don't think they took your Coins back to themselves but I am suspecting someone very close bto you did it. Normally wallet password is always in the brain and it is not written down on paper except the seed phrase which is very long to memorize. I believed it was your carelessness make the person to transfer the coins to his or her wallet.
I have heard such similar story ina family, a boy took his mom phone and transfer $20 to his account and delete the debit alert from the mother's phone so that she would not know that he took the money from her account, and finally he was caught on other times. So I am trying to also  think from that angle too that someone you know might have used your device to do the transfer and returned or dropped it the way it was so you wouldn't notice.

[hosseinimr93]

Do you think coinomi themselves stole these funds because it is closed source and they can get access to keys or anything ?

There is no way to know that. We don't know whether they have access to users keys or not.

The coinomi wallet is being used by so many people and they have a name in the market. They would not stole people funds, as if they do, they will have a bad reputation and people will stop using this wallet.

Being used by many people doesn't mean that's safe. Visit the following topic and see how a vulnerability caused a coinomi user to lose all his money.
WARNING - Coinomi Wallet CRITICAL Vulnerability Made Me Lose My Life Savings

I guess there may be fault at the OP end which made him lose all his money.

This is the most probable case.

[aylabadia05]

The wallet was drained on Feb 14th.  The password was in my head not on paper.  The seed phrase was on paper in a safe which only I have access to.  Coinomi denies all responsibility and basically says too bad so sad.  My wife and I are retired, the wallet held our "safe" retirement cash savings.  Stay away from this wallet. 

What to say if the kite has broken the rope that causes it to be lost to the wind. It is not the wind's fault that the kite broke, but that the string was not strong enough.

The three possibilities mentioned by hosseinimr93 are very accurate. In storing assets, please make sure that the source of the wallet has nothing to do with them regarding the seed phrase.

1. It's possible that you used a weak password and someone was able to brute-force it.
2. It's possible that someone had access to your seed phrase.
3. It's possible that your device was compromised.

Storing assets for the future, why not spend a little money to buy a hardware wallet to be truly secure, although there are also software wallets that provide good security such as Electrum.

[Wind_FURY]

The thing with software wallets is that there's always a chance of a private key leak simply due to the fact that your wallet's private keys were generated through your computer/mobile device. And add the fact that it's closed source? We have no idea how secure the wallet app is.

Next time, grab a hardware wallet.

I believe it's more probable that OP was a victim of a phishing attempt, or his/her computer was hacked, than Coinomi software had a private key leak, or if Coinomi was a nefarious entity that steals private keys themselves like what OP is giving that impression. Because if it's true/proven, then they are legally liable.

[Pmalek]

Actually it's in the ToS that nobody reads. And stated a few other times & places. More or less it boils down to 'we are not responsible for anything'...

That's right. You can find the same things in the terms of centralized exchanges. They use a few different ways for how they call it. For example, "unforeseen circumstances" or "extraordinary situations". Getting your wallet/account hacked is considered an extraordinary situation because the service provider can't do anything about the way you handle your security.

...there are also software wallets that provide good security such as Electrum.

Electrum's cold wallet feature is a good solution. Using Electrum as a hot wallet isn't such a security upgrade if you don't know what you are doing. We don't know how OP lost his coins. Whatever he did with Coinomi, he could have in theory also done with Electrum with the same outcome.

[Z-tight]

or if Coinomi was a nefarious entity that steals private keys themselves like what OP is giving that impression. Because if it's true/proven, then they are legally liable.

How do you hold them liable or prove it, they are closed source and you cannot verify their codes or check if they did something behind the scenes that caused the loss, so there is no case to even begin with. And i am sure their terms of service would read that they are not "liable for any customers loss", these companies know things like loss of funds and assets would happen, so do not think they will leave themselves exposed, they can defend themselves easily, that's why it is better to protect your funds than to be in this "helpless" situation.

[Pmalek]

How do you hold them liable or prove it, they are closed source and you cannot verify their codes or check if they did something behind the scenes that caused the loss, so there is no case to even begin with. And i am sure their terms of service would read that they are not "liable for any customers loss"...

I don't know any wallet that can be held responsible for the actions of its users, open or closed-source. If Coinomi (or any other wallet for that matter) was stealing money left and right, you would have hundreds of people finding this forum the same way OP did and sharing their stories of waking up one day and noticing all their crypto was gone. But we don't have that.

I think the most nefarious client that is often mentioned in the scam accusation board is Freewallet.   

[sheenshane]

How do you hold them liable or prove it, they are closed source and you cannot verify their codes or check if they did something behind the scenes that caused the loss, so there is no case to even begin with. And i am sure their terms of service would read that they are not "liable for any customers loss"...

I don't know any wallet that can be held responsible for the actions of its users, open or closed-source. If Coinomi (or any other wallet for that matter) was stealing money left and right, you would have hundreds of people finding this forum the same way OP did and sharing their stories of waking up one day and noticing all their crypto was gone. But we don't have that.

Mostly some cases that I've heard in Coinomi wallet are that frustrating with huge fees but not losing their fund or being scammed.
It might difficult to hold their developers or providers liable for any loss of funds (even any wallet, an open-source, close-source, and even software wallet).  Without access to the source code, it can be challenging to prove any wrongdoing on their part or determine if any vulnerabilities in the code led to the loss.  As also many we can see that most wallets will include disclaimers in their terms of service to protect themselves from liability in case of a loss.

I think the most nefarious client that is often mentioned in the scam accusation board is Freewallet.   

Worst than the Coinomi wallet and I tend to agree with this.