A Non-Custodial wallet, Atomic Wallet, being compromised

[Wind_FURY]

This announcement/warning made six hours ago through Atomic Wallet's Twitter account.

We have received reports of wallets being compromised. We are doing all we can to investigate and analyse the situation. As we have more information, we will share it accordingly.

For any questions and concerns, contact support@atomicwallet.io

https://twitter.com/AtomicWallet/status/1664946301815910400?cxt=HHwWgMCzneP1iZsuAAAA

It's still being investigated, and no one actually knows if their software is really being compromised or not. But better be safe than to lose all of your coins/savings. If you're an Atomic Wallet user, send them out to another wallet ASAP.

[1714305678]

1714305678

[1714305678]

1714305678

[1714305678]

1714305678

[Charles-Tim]

I wonder why people should still be using a wallet that support only legacy address when there is Segwit today. Any bitcoin wallet, that also support altcoins or not should not be used anymore if they can not follow the recent standards.

[OmegaStarScream]

It could be a phishing attack targeting their users. I don't see how their software can be compromised unless they were lying about how are the private keys generated and them being non custodial.

[AprilioMP]

This announcement/warning made six hours ago through Atomic Wallet's Twitter account.

If you're an Atomic Wallet user, send them out to another wallet ASAP.

A news that will make many users disappointed if all the funds stored in the AtomicWallet wallet are lost.
There is a twitter account with the username @Christomos03 replying to a tweet made by AtomicWallet with a reply requesting that the lost funds be returned. Promptly replied by @zachxbt asking to send a DM with the transaction hash of the stolen funds.

It's been 8 hours since the information was made by AtomicWallet that they were compromised, is it still possible for Atomic walet users to transfer funds?

Any bitcoin wallet, that also support altcoins or not should not be used anymore if they can not follow the recent standards.

What about other wallets that support multiple coins?

[OmegaStarScream]

-snip-
is it still possible for Atomic walet users to transfer funds?

They should be able to but if not, they can always recover their wallet somewhere else and then transfer funds from there.

[Stalker22]

I couldn't find any specific information on whether incident reports are related to a particular platform, such as desktop or mobile, or if they are related to all wallet versions. It would be helpful to have more clarity on this matter.

By the way, why is this thread in the Web wallets section?

[JeromeTash]

I have seen reports of users losing their funds, and they even have no idea what happened since they never exposed their private keys or seeds.
One more reason never to trust closed source wallets.

Interesting posts of their Subreddit: https://www.reddit.com/r/atomicwallet/

[sheenshane]

It's sad news, we thought that using a non-custodial wallet is safe, in fact, there's no really safe over the internet.
Just wanted to know now how much worth was being stolen by hackers, I saw comments on Twitter, other wallets are fine and some are drained out I start thinking now of what version of the wallet and what software they use.

I think should also be visible in the Beginners and Help section to warn newbies out there and start importing their wallets to those who are not yet affected.  Transferring their fund by importing the 12 words into other wallets like Electrum might be a good step or any wallets that support importing BIP39 seed phrases.

[hosseinimr93]

It's sad news, we thought that using a non-custodial wallet is safe, in fact, there's no really safe over the internet.

It's safe to use a trustworthy open-source non-custodial wallet (preferably on an airgapped device) and that has been said many times in many threads on this forum. It's not that any non-custodial wallet is recommended.

Transferring their fund by importing the 12 words into other wallets like Electrum might be a good step or any wallets that support importing BIP39 seed phrases.

You don't make your wallet more secure, just with importing your seed phrase into a secure wallet like electrum. You should create a new wallet and send all the fund to that.

[RickDeckard]

After reading some comments on both the Reddit official thread[1] and their Twitter thread[2], I feel sorry for the people that lost their funds. According to this[3] user from Twitter, he estimates that a minimum of $20m has been stolen (so far at least). Match Systems appears to have some lead[4] regarding what might have caused this hack:

The breach was instigated by a recent update to the Atomic Wallet's official website. It appears the attackers gained access to user private keys and passwords by modifying the source code of the application on the server.

If true, then I'm not sure if they will be able to stop the hacker from keep sucking away their users funds. It's just a matter of time until all wallets are drained (whoever was able to exploit this surely has a way to automate this process).
[1]https://safereddit.com/r/atomicwallet/comments/13z9wdw/we_are_investigating/
[2]https://nitter.it/AtomicWallet/status/1664946301815910400
[3]https://nitter.it/zachxbt/status/1665151915355676674
[4]https://nitter.it/MatchSystems/status/1665116869450145792

[bittraffic]

So many users lost thier altcoins. Even so its not fun losing a huge quantity of those tokens like XRP or ADA. This is the kind of hacks that users will question whether the Wallet developer is liable. Because if they store those tokens on exchange like Binance, users who lost tokens could have refunded.

The wallet is not opensource by the way.

[WhyFhy]

Sad day for Atomic Wallet users, It's (another) stark reminder. Not your keys, not your coins.

[hosseinimr93]

Sad day for Atomic Wallet users, It's (another) stark reminder. Not your keys, not your coins.

Atomic wallet is a non-custodial wallet and gives you the private keys. The problem with Atomic wallet is that it's close source and there is no way to know how the keys have been generated and whether the user is the only who has access to the keys or not.

[hugeblack]

The only advantage of that wallet is the ability to integrate the wallet with automatic/instant exchange, in other words, easy to exchnage between cryptocurrencies, but I see it as a lazy user, I hope that they have not lost a lot.
Are all users lost their money? Or is there a certain reason to lose their money, I use the phone and I did not find time to track the story.

[o_e_l_e_o]

I don't see how their software can be compromised unless they were lying about how are the private keys generated and them being non custodial.

Atomic wallet is closed source. Anything could be hiding in the code, not just from them being actively malicious but also from a rogue employee sneaking something in, a malicious third party sneaking something in, someone compromising their app store account to upload a malicious app, or even just plain incompetence.

I am also reminded of the Copay wallet hack several years ago. Copay had a dependency on a specific JavaScript library which was no longer maintained. A malicious third party obtained control of this library, merged a malicious update, and it was pulled in to Copay updates without anyone realizing.

Just another in the long list of reasons to never use closed source wallets.

On top of that, Atomic wallet is owned is owned by Binance which historically has few questionable behavior.

Are you confusing them with Trust wallet? I didn't think Atomic was also owned by Binance?

[Stalker22]

On top of that, Atomic wallet is owned is owned by Binance which historically has few questionable behavior.

Are you confusing them with Trust wallet? I didn't think Atomic was also owned by Binance?

Yeah, I was confused between Atomic and Trust wallet. Their homepage which show review from "CZ Binance" on Trustpilot[1] also add confusion since i remember CZ Binance also promote Trust wallet on Twitter some time ago[2].

I have been searching around this forum, but I could not find any previous discussions about this specific topic. However, I did come across a few articles from 2018 that shed some light on the partnership between CZ Binance and Konstantin G., who is the CEO and founder of AtomicWallet and the former CEO and co-founder of Changelly.

https://www.unlock-bc.com/news/2018-05-03/changelly-partnered-with-binance-konstantin-met-with-cz-in-malta/

[DaveF]

I don't see how their software can be compromised unless they were lying about how are the private keys generated and them being non custodial.

Atomic wallet is closed source. Anything could be hiding in the code, not just from them being actively malicious but also from a rogue employee sneaking something in, a malicious third party sneaking something in, someone compromising their app store account to upload a malicious app, or even just plain incompetence.

I am also reminded of the Copay wallet hack several years ago. Copay had a dependency on a specific JavaScript library which was no longer maintained. A malicious third party obtained control of this library, merged a malicious update, and it was pulled in to Copay updates without anyone realizing.

Just another in the long list of reasons to never use closed source wallets.

On top of that, Atomic wallet is owned is owned by Binance which historically has few questionable behavior.

Are you confusing them with Trust wallet? I didn't think Atomic was also owned by Binance?

For those of you like me that did not remember if you left any funds in there (I had an entire $2 of tron so no big deal) just put your phone in airplane mode or disconnect your internet from you PC and check. And then if needed get your private keys. Don't start with getting the keys and importing do a time / effort analysis.


Copay was open source.
But as I have said countless times. Open source and build verified still does not prevent bad coding. Or as you mentioned a supply chain attack.
It just allows more people to see the bad code and report it and get it fixed.

And also as I have said countless times. Open source don't mean shit if people don't verify the source vs compiled that you are downloading. And lets not forget the HOW SECURE IS THE PROCESS OF UPLOADING THE APP TO THE VARIOUS APP STORES.
Everything else could be perfect, but if you don't secure that system then you are not secure.

-Dave

[BlackHatCoiner]

Interesting posts of their Subreddit: https://www.reddit.com/r/atomicwallet/

Why can't I find one helpful Reddit post, ever? I mean, look at the first reply of We are investigating.

My wife and I just noticed we lost all of our XRP! Over 90,000 tokens fucking gone what the hell is going on?!

Edit: All our Bitcoin is gone as well we were just so surprised about the XRP we didn't realize. We keep hugging each other we thought this was supposed to be cold storage.

I love how the reply email tells us not to share our keys "we don't" and to contact exchanges so they can block addresses like this was somehow our fault.

FUCK YOU Atomic Wallet

Why do people choose to not use reputable, open-source software when it comes to their life savings? I mean, you seriously don't think it's a good idea to spend an hour or two extra, to ensure you won't just let a stranger ruin your life?

[Cricktor]

It's sad news, we thought that using a non-custodial wallet is safe, in fact, there's no really safe over the internet.
Transferring their fund by importing the 12 words into other wallets like Electrum might be a good step or any wallets that support importing BIP39 seed phrases.

So IMO it would be better if Atomic wallet move their coins/token by importing recovery words to other wallet rather than opening their Atomic wallet application.

A software wallet is only as safe as the computer and OS used to run it. If the computer is compromised then malware with sufficient elevated rights can compromise the software wallet. If the software wallet itself is badly crafted, which you can't check with closed-source software, then you're screwed anyway.

Importing the BIP-39 compatible recovery words of the Atomic Wallet in another wallet only makes sense if you can exclude the possibility that those recovery words or the underlying seed wasn't already compromised. Sure, if the current attack on Atomic Wallet needs some more ongoing interaction with the Atomic Wallet software, then you may gain some ground by importing it in another verified wallet that supports all your coins and tokens. Sadly, many alternatives are closed-source, too, with very few exceptions (I believe Unstoppable Wallet is multi-coin and open-source).

Even more sadly is that those closed-source wallets mostly don't offer the use of a hardware wallet with them. If implemented properly and without malicious intends that would mostly prevent a compromise of the seed and/or private keys that are secured by the hardware wallet.

[Fivestar4everMVP]

This is a rather sad news, I am rather a bit surprised that this has to happen, my astonishment is probably due to the fact that it is a non-custodial wallet that is involved in this hack, we I think we are very used to custodial wallet, and centralized platforms being hacked, a non-custodial wallet hack is rather new and shocking, and some would want to ask questions like, if a non-custodial wallet can be hacked, then which type of wallet is exactly safe?

I think the above question can only be answered after the management of Atomic wallet come out with a comprehensive reason of what lead to the hack, and let's hope they are sincere to their users and the entire crypto community at large.