Coinomi wallet hacked, all funds stolen

[Pezroly]

This is very strange. From Coinomi support - https://coinomi.freshdesk.com/support/solutions/articles/29000009711-if-a-hacker-penetrates-your-servers-will-he-steal-my-coins- - "Someone can only access your coins if; - He has access to your recovery phrase/private keys. - If he has access to your device and knows your app password." - https://coinomi.freshdesk.com/support/solutions/articles/29000013344-can-a-thief-hack-bruteforce-my-stolen-lost-device-and-spend-my-funds- - "Coinomi is a security-first wallet, it has been around since 2014 and no user wallet has ever been hacked or otherwise compromised, and that is for a reason."
Maybe you have serious malware or keylogger in your computer. Try to scan your computer with good antivirus software and also Malwarebytes software from here https://www.malwarebytes.com/.

[1714229853]

1714229853

[virasog]

This is very strange. From Coinomi support - https://coinomi.freshdesk.com/support/solutions/articles/29000009711-if-a-hacker-penetrates-your-servers-will-he-steal-my-coins- - "Someone can only access your coins if; - He has access to your recovery phrase/private keys. - If he has access to your device and knows your app password." - https://coinomi.freshdesk.com/support/solutions/articles/29000013344-can-a-thief-hack-bruteforce-my-stolen-lost-device-and-spend-my-funds- - "Coinomi is a security-first wallet, it has been around since 2014 and no user wallet has ever been hacked or otherwise compromised, and that is for a reason."
Maybe you have serious malware or keylogger in your computer. Try to scan your computer with good antivirus software and also Malwarebytes software from here https://www.malwarebytes.com/.

Why is it that every time a person losses his fund from a personal wallet, he makes the owners of the wallet company scam and responsible for his / her? Most of the time people lose money by their own carelessness but they try to put the blame on others that the wallet is not secure and other things which are not true.

No one will take anyone's loss, therefore we need to protect our assets and protect our wallets by ourselves. Nothing would be benefit by blaming others.

[Pmalek]

This is very strange.
"Someone can only access your coins if; - He has access to your recovery phrase/private keys. - If he has access to your device and knows your app password."

I guess you mean it's strange that the OP claims Coinomi is somehow at fault for his coins being stolen. If not, let's analyze those support comments. I didn't read the sources, so I am only focusing on the parts you highlighted.

There is nothing strange about what the source says. Whoever has the seed or private keys can remotely access and spend whatever coins are stored in the corresponding addresses. If someone gets hold of your phone where you have Coinomi installed, he can open the app without a password. However, if he wants to make a transaction, he needs to enter the password. If he wants to see the seed or make account changes, he also needs a password.

[Z-tight]

No one will take anyone's loss, therefore we need to protect our assets and protect our wallets by ourselves. Nothing would be benefit by blaming others.

When people's wallet gets hacked and their funds are stolen, at that immediate time they are usually very confused and since they do not know what exactly happened, they blame the software or hardware wallet they used to store their money, this is because many people who own crypto today do not even know how to store it in a safe enviroment, they wrongly think it is the software or hardware wallet they use that secures their funds, they do not know their funds are only safe through their actions.

[Lida93]

The wallet was drained on Feb 14th.  The password was in my head not on paper.  The seed phrase was on paper in a safe which only I have access to.  Coinomi denies all responsibility and basically says too bad so sad.  My wife and I are retired, the wallet held our "safe" retirement cash savings.  Stay away from this wallet. 

It all makes more sense now why a hardware wallet is far safer to all these software wallets. Situations like this one are very complicated in actually pointing a finger on where the compromise emanated from either from OP or coinomi. Sometimes these computer's we use for our wallets could generate a malware unknown to the owner or at one point we might have click on an unsuspecting link or ads unknowingly or it could have been a security breach on the part of Coinomi (which is rare) or maybe OP PSW wasn't strong enough. Like the more the hints on the issue the more it keeps getting complicated as both OP or Coinomi ain't even ready to take responsibility for the loss funds.

Next time, don't dump all your savings in a single wallet and if I may ask, does your wife have any idea about your PSW or seed phrase?

[Mame89]

Why is it that every time a person losses his fund from a personal wallet, he makes the owners of the wallet company scam and responsible for his / her? Most of the time people lose money by their own carelessness but they try to put the blame on others that the wallet is not secure and other things which are not true.

No one will take anyone's loss, therefore we need to protect our assets and protect our wallets by ourselves. Nothing would be benefit by blaming others.

agree with your opinion, because the security of a wallet or trading account in the crypto market can occur and may be caused by security failures on the platform used. However, in some cases, hacking can occur due to the trader's own fault. Like Phishing, it is sometimes our fault that we are always careful and not thorough when providing personal information online or through suspicious emails.

As a trader, it is very important to take proper security measures to protect accounts and crypto assets from hacking attacks. By paying attention to this security, we can minimize the risk of losses caused by hack attacks or the like.

[Z-tight]

It all makes more sense now why a hardware wallet is far safer to all these software wallets.

Hardware wallets are safe because the keys are stored offline, any software wallet that the keys are generated offline and the wallet software kept in an airgapped device that would never be connected to the internet is as safe as a hardware wallet. Protecting your backup is also very important, and it does not matter the wallet that is used, if your recovery phrase is stolen, your money would be stolen.

Next time, don't dump all your savings in a single wallet

Using a multisig wallet or more than one wallet is good and safer, but you have more backups to protect.

and if I may ask, does your wife have any idea about your PSW or seed phrase?

Hey, do not open a pandorax box here .

[virasog]

It all makes more sense now why a hardware wallet is far safer to all these software wallets.

Hardware wallets are safe because the keys are stored offline, any software wallet that the keys are generated offline and the wallet software kept in an airgapped device that would never be connected to the internet is as safe as a hardware wallet. Protecting your backup is also very important, and it does not matter the wallet that is used, if your recovery phrase is stolen, your money would be stolen.

Next time, don't dump all your savings in a single wallet

Using a multisig wallet or more than one wallet is good and safer, but you have more backups to protect.

No matter whether you have a hardware wallet or software wallet, you need to protect it, and keep the seed phrases safe and at a secure place. Even if you got a hardware wallet and someone in your home has access to the seed phrase and the wallet itself, anything can happen.

and if I may ask, does your wife have any idea about your PSW or seed phrase?

Hey, do not open a pandorax box here .

I don't think it is a pandora box but a reality. How many times it is our near and dear ones who took away our money and we blame the software company developing the wallet to be not up to the standards?

[PX-Z]

I just read this thread and it's very unfortunate. I used coinomi wallet although i don't store large funds there but i have never been hacked even on other wallets that is "closed-source" i used and currently using.
So in this case the problem i only see is the users' device, or the way or where the backup seed is saved.

[Pmalek]

Hardware wallets are safe because the keys are stored offline, any software wallet that the keys are generated offline and the wallet software kept in an airgapped device that would never be connected to the internet is as safe as a hardware wallet.

Properly generated and stored airgapped wallets are even safer than hardware wallets. You still have to have some trust in the device manufacturers and their abilities to not mess up. If they are closed-source, like the biggest hardware wallet seller is, you need even more trust. Remember the recent case with OneKey hardware wallets and how their team messed up.

A properly airgapped computer has no internet access or contact with anything else that does. Everything you do remains in that local (much harder to penetrate) environment.   

[Z-tight]

A properly airgapped computer has no internet access or contact with anything else that does. Everything you do remains in that local (much harder to penetrate) environment.   

You are correct, but to properly set up an arigapped wallet in a completely safe enviroment is hard for newbies to do, and they can easily mess up and lose their funds, hardware wallets are easier for them to use correctly. I have even seen someone suggesting using an airgapped computer that is only connected to the internet once in a while , once connected to the internet it really isn't airgapped anymore, so on that note i think there is more work to be done generating and using an airgapped wallet than a hardware wallet.

I don't think it is a pandora box but a reality. How many times it is our near and dear ones who took away our money and we blame the software company developing the wallet to be not up to the standards?

I believe if you cannot trust your spouse with your seed phrase or very important things, you both should not be married at all.

[Pmalek]

You are correct, but to properly set up an arigapped wallet in a completely safe enviroment is hard for newbies to do, and they can easily mess up and lose their funds, hardware wallets are easier for them to use correctly.

In truth, It's not something that newbies should do. Airgapped systems are for the more advanced userbase. Beginners will be safe enough if they move their coins from centralized exchanges (or don't use them to begin with), are careful what they click/download/give permissions to, and use a hardware wallet from a top manufacturer. They can slowly improve their knowledge with time and if they want to.   

I have even seen someone suggesting using an airgapped computer that is only connected to the internet once in a while , once connected to the internet it really isn't airgapped anymore...

That's like saying I am a virgin because I only have sex once a week. I am a 100% virgin during the other days, though.

[virasog]

I just read this thread and it's very unfortunate. I used coinomi wallet although i don't store large funds there but i have never been hacked even on other wallets that is "closed-source" i used and currently using.
So in this case the problem i only see is the users' device, or the way or where the backup seed is saved.

The problem is most probably with the user's carelessness and then blaming the Coinomi wallet not build upto the standard.
No matter the wallet is closed source or open source, we need to know the basis on how to keep our wallet safe and unfortunately most people in the crypto world don't know the basics.

A properly airgapped computer has no internet access or contact with anything else that does. Everything you do remains in that local (much harder to penetrate) environment.   

You are correct, but to properly set up an arigapped wallet in a completely safe enviroment is hard for newbies to do, and they can easily mess up and lose their funds, hardware wallets are easier for them to use correctly. I have even seen someone suggesting using an airgapped computer that is only connected to the internet once in a while , once connected to the internet it really isn't airgapped anymore, so on that note i think there is more work to be done generating and using an airgapped wallet than a hardware wallet.

For newbies, even a hardware wallet may not be suitable unless they know how to use it. The best bet for the Newbies is to use a centralized exchange and / or centralized wallet which is controlled by the password and 2fa. Newbies know this stuff and until they learn about the seed phrases, wallets, and stuff the best option would be the centralized wallets.

[pooya87]

The best bet for the Newbies is to use a centralized exchange and / or centralized wallet which is controlled by the password and 2fa.

People should never sacrifice security for convenience even newbies. The centralized exchanges and in general all custodian accounts are very risky to use regardless of how convenient they may look like. There are countless cases of exchanges being hacked, accounts being shut down for no reason, exchanges scamming their users and running away, etc. No amount of password and 2FA can save you from it.

[Z-tight]

The best bet for the Newbies is to use a centralized exchange and / or centralized wallet which is controlled by the password and 2fa. Newbies know this stuff and until they learn about the seed phrases, wallets, and stuff the best option would be the centralized wallets.

No, this is not a recommended advice to give to newbies, if newbies start storing their funds in a centralized exchange, it will be hard for them to stop it, and before you know it they could have a large amount of funds stored in a centralized exchange, which is not safe for them, centralized exchanges gamble with users money, they can be hacked or they can even confiscate users funds without any notice. Newbies can start with a wallet like Electrum, it is so easy to use and they will have their seed phrase, though it is a hot wallet, but with time they will learn how to set up and use an airgapped computer in a safe enviroment or use a hardware wallet easily.

[virasog]

The best bet for the Newbies is to use a centralized exchange and / or centralized wallet which is controlled by the password and 2fa.

People should never sacrifice security for convenience even newbies. The centralized exchanges and in general all custodian accounts are very risky to use regardless of how convenient they may look like. There are countless cases of exchanges being hacked, accounts being shut down for no reason, exchanges scamming their users and running away, etc. No amount of password and 2FA can save you from it.

The reason i said this because newbies are well aware and used to access the websites which are accessed by passwords only. You can see the OP example where he loses the funds from Coinomi wallet and it is most probably because he was not able to safe guard his private seed (though he do not admit his mistake)

The best bet for the Newbies is to use a centralized exchange and / or centralized wallet which is controlled by the password and 2fa. Newbies know this stuff and until they learn about the seed phrases, wallets, and stuff the best option would be the centralized wallets.

No, this is not a recommended advice to give to newbies, if newbies start storing their funds in a centralized exchange, it will be hard for them to stop it, and before you know it they could have a large amount of funds stored in a centralized exchange, which is not safe for them, centralized exchanges gamble with users money, they can be hacked or they can even confiscate users funds without any notice. Newbies can start with a wallet like Electrum, it is so easy to use and they will have their seed phrase, though it is a hot wallet, but with time they will learn how to set up and use an airgapped computer in a safe enviroment or use a hardware wallet easily.

I never advise newbies or recommend them to use centralized wallets or exchanges. The only thing i am saying is that they should educate themselves on how to secure the seed phrases before storing their crypto in wallets like Electrum. Yes, the process is easy to learn but there may be some who may never want to learn.  

[pooya87]

The reason i said this because newbies are well aware and used to access the websites which are accessed by passwords only. You can see the OP example where he loses the funds from Coinomi wallet and it is most probably because he was not able to safe guard his private seed (though he do not admit his mistake)

That makes more sense. Although I still wouldn't call it "the best" but I can see the benefit of using a custodial account for certain types of people who have a hard time using things that are different. But only as long as they see it as the transitional wallet, something they use first but are planning on moving on from it to a better solution.

[Aikidoka]

I never advise newbies or recommend them to use centralized wallets or exchanges. The only thing i am saying is that they should educate themselves on how to secure the seed phrases before storing their crypto in wallets like Electrum. Yes, the process is easy to learn but there may be some who may never want to learn.  

It's true that many newbies do not take security as a serious deal and no joke about it, but it's actually one of the most important aspects to consider when creating a Bitcoin wallet. It's crucial to think carefully about how to secure your seed phrase, private keys, and passwords from potential hackers. I would not recommend trusting any centralized hot wallet, but instead I'll suggest at least to create an open-source wallet like Electrum. It would be even better to use a hardware wallet or make your electrum wallet air-gapped, which is impossible to hack online, but only just physically.

Unfortunately, many people only learn about the importance of security after experiencing a loss or hack  . It's essential to prioritize security when dealing with Bitcoin, rather than focusing solely on earning more BTC.

[bettercrypto]

It's sad that there has been theft of assets from other communities here in the crypto space. Both of you are retired and then the same thing happened.

        As far as I know, this coinomi does not provide the latest updates on their social media platforms. Their last announcement on twitter was in April 2022, after these times they have not given any latest plan and development for the community of coinomi and there are many users complaining about it.

[Z-tight]

I never advise newbies or recommend them to use centralized wallets or exchanges. The only thing i am saying is that they should educate themselves on how to secure the seed phrases before storing their crypto in wallets like Electrum. Yes, the process is easy to learn but there may be some who may never want to learn.  

I get the thing you are saying now, but i don't think they should educate themselves by depositing their money into centralized exchanges and leaving it there for the period of learning, they may lose it before they learn anything. Newbies can start directly with Electrum, it is easier to use and set up that registering on a centralized exchange and giving them your kyc documents, so Electrum is a good start, and i think everyone knows how to hide something, so with good opsec they will keep their seed phrase safe, and afterwards they can start learning things like how to set up a wallet in an air-gapped way and how to use a hardware wallet, etc.