A Non-Custodial wallet, Atomic Wallet, being compromised

[Yamane_Keto]

I own 12 coins (BTC - ETH - XRP - ADA - SOL - DOT - LTC - MATIC - BCH - AVAX - XLM - DASH)

You have limited options for a good, open source multi-currency wallet, and those options may be limited to Unstoppable wallet which may have sync issues or slow sync.

The best thing is to be wise in your investments and try to reduce altcoin investment, because you do not diversify your investments, but rather increase the risk potential while reducing the return on investment. In this case, hardware wallets give a safe and easy-to-manage option instead of software wallets.

Find a suitable option here https://wallets.thebitcoinhole.com/ and ask the community if it is suitable for you.

[RickDeckard]

Sell all the shitcoins for BTC and then store the BTC in either an open source hardware wallet such as Passport or on an airgapped cold storage device using Electrum.

If you want to keep holding shitcoins for some reason, then you are going to be stuck using insecure or closed source wallets. Your best bet will be some multi-coin hardware wallet.

The only wallet that comes to my mind that ticks the box of being open source and having their code reproducible[1] is Trezor Model T[2]. As it currently stands and considering some recent decisions I can no longer recommend moha sasa to buy it, but I guess that he is also free to read up on the recent changes that Trezor made and decide for himself if he's comfortable with them.

If it was me I would follow the suggestion made by o_e_l_e_o @moha sasa - the coins that you are currently holding basically are the ones that keep appearing on the news over and over again in the past months/years and I understand that you might want to try your luck in securing profits in the long run. However, as I don't fully understand their applicability/usage/"worthiness"(?) in the real world I would also sell them all and buy bitcoin instead.

Note: While searching for an open source wallet for holding your coins you may find Keystone[3]. However be advise that it may not be as open source as it looks considering that you have to sign an NDA[4] in order to view sections of the code that aren't available in their GitHub.
[1]https://walletscrutiny.com/hardware/trezorT/
[2]https://trezor.io/trezor-model-t
[3]https://github.com/KeystoneHQ
[4]https://walletscrutiny.com/hardware/cobovaultessential/

[Myleschetty]

What is the best choice for me? and Why?

+ Thanks in advance and to anyone who contributed in this thread.

Both Guarda and Exodus Wallet are not open source there's a chance that there are some flaws or back doors in the wallet which is yet to be known since no hack or dev exit scam has happened.
The best choice is for you to get a hardware wallet due to ease of use ^{(however you need to learn how to use it safely in other not to expose your crypto to danger)}, secure transactions, security, etc.

[dkbit98]

What is the best choice for me? and Why?

Best choice for you is to stop using so much shitcoins and switch to using mostly Bitcoin.
As a gradual transition you can try using Unstoppable wallet, that works on mobile devices and it is open source, but I am not sure if it support all the coins you mentioned.
Best choice is using open source hardware wallets like Trezor, Bitbox or Keystone because they have good support for coins.
Don't use any closed source or custodial wallets.

[Cricktor]

One honestly wonders how they came up with the ~1% or ~0.1% of the affected users?
How do they differentiate addresses/seeds created through their wallet from those create through other wallets?

Because they log everything you do. It's a closed source wallet which communicates exclusively through their servers. They know exactly how many users they have, and exactly which addresses belong to whom.

I remember having read somewhere (sorry, no sources to quote) that Atomic Wallet uses a hash of the recovery words as a wallet identifier and this wallet identifier appears to be communicated to the backend for whatever reasons. So Atomic Wallet knows exactly how many distinct wallets there are and talk back to their infrastructure.

Download numbers are not very accurate and might be counted multiple times for a single individual. The internal wallet identifier of active wallets is much more accurate, but no public data.

[DaveF]

Just did a quick look around, has there been ANY update anywhere on this?

At this point they are not ever going to be considered secure again, but they seem to have just stopped mentioning it and as far as I can tell so have a lot of the online places that I read.

Just seems odd that all of a sudden, no more discussion. Although, the other side of it is how much more then 'they suck, don't use them' can be said.

-Dave

[Z-tight]

Just did a quick look around, has there been ANY update anywhere on this?

None that i have heard or seen of, i think the bigger issue here is that Atomic Wallet doesn't know what caused the mass attack of their customers, so i don't think we are looking forward to any update. It is closed source, they don't know what caused the hack, then it can happen again!

Just seems odd that all of a sudden, no more discussion. Although, the other side of it is how much more then 'they suck, don't use them' can be said.

They are closed source, so they were not really "safe" even before the hack, and no matter how many times we can say 'don't use them', so many people are still using Atomic Wallet. If after all the recent events regarding the collapse of centralized exchanges and earning platforms, people still use them to store their funds and to earn APY, surely people are still going to use Atomic Wallet to hold their funds after this hack.

[DaveF]

Just did a quick look around, has there been ANY update anywhere on this?

None that i have heard or seen of, i think the bigger issue here is that Atomic Wallet doesn't know what caused the mass attack of their customers, so i don't think we are looking forward to any update. It is closed source, they don't know what caused the hack, then it can happen again!

Just seems odd that all of a sudden, no more discussion. Although, the other side of it is how much more then 'they suck, don't use them' can be said.

They are closed source, so they were not really "safe" even before the hack, and no matter how many times we can say 'don't use them', so many people are still using Atomic Wallet. If after all the recent events regarding the collapse of centralized exchanges and earning platforms, people still use them to store their funds and to earn APY, surely people are still going to use Atomic Wallet to hold their funds after this hack.

that

We don't know that THEY don't know what happened. All we know is that WE don't know since they have not told us.

But the lack up updates, even to the extent of not posting a 'we don't know what went wrong still looking' is just a total lack of customer service / caring.

Their reputation is so shot at this point it probably does not matter for people here who pay attention, but since they are still out there someone else is still going to loose their funds

-Dave

[Yamane_Keto]

that

We don't know that THEY don't know what happened. All we know is that WE don't know since they have not told us.

They care more about promoting their service than even customer safety, and I wouldn't be surprised if the recent hack was caused by a former employee or an internal attack. I tried to search for words such as atomic wallet, atomic wallet review using some browsers and different IP addresses and I did not find any details about this hack on the first page. even google keywords like atomic wallet hack will get link like Atomic Wallet Claims 'Less Than 0.1%' of Users Affected by $100M Hack

Their reputation is so shot at this point it probably does not matter for people here who pay attention, but since they are still out there someone else is still going to loose their funds

Our role should be to showing how bad this wallet is as a first result in search engines and convincing ChangeNOW's third-party services to stop supporting them (although ChangeNOW has a long history of suspicious activity)

[RickDeckard]

For anyone that wants to keep updated regarding Atomic Wallet hack, this[1] twitter account may be useful to follow. They share relevant updates regarding anything to due with the hack which is still enshrouded in a veil of mystery. I have some reasons to believe that Atomic will eventually cease to exist in the next couple of months.
[1]https://nitter.nl/whathappenedwaw

[Wind_FURY]

Just did a quick look around, has there been ANY update anywhere on this?

None that i have heard or seen of, i think the bigger issue here is that Atomic Wallet doesn't know what caused the mass attack of their customers, so i don't think we are looking forward to any update. It is closed source, they don't know what caused the hack, then it can happen again!

Because it's closed source doesn't mean that they do not know what caused the hack, they probably do. It should actually be BECAUSE it's closed source that the community should be more suspicious. The Atomic developers can check the code, but the open source community can't. What could go wrong?

¯\_(ツ)_/¯

[daworm06]

I was one of those hacked. I always use atomic wallet on a dedicated laptop that is not used for anything else other than a wallet. I couldn't get my EOS to send, so support recommended I download the wallet to another device and I did, to my cell phone on May 31, from the Apple store. I believe that my account was compromised when I entered the seed phrase on  my Iphone. What do you think?

[un_rank]

...so support recommended I download the wallet to another device and I did, to my cell phone on May 31, from the Apple store. I believe that my account was compromised when I entered the seed phrase on  my Iphone. What do you think?

Except your iPhone was compromised there is no way to know if your wallet was breached when you imported it into your mobile device.

The time frame between you importing the seedphrase and the wallet hack announcement is very close and since they probably released an update late it is very plausible that their system malfunction caused you to not be able to send you EOS coins out.

I think Atomic being a closed source wallet should not be used, along with other closed source, custodial wallets.

- Jay -

[Cricktor]

... I couldn't get my EOS to send, so support recommended I download the wallet to another device and I did, to my cell phone on May 31, from the Apple store. I believe that my account was compromised when I entered the seed phrase on  my Iphone. What do you think?

Did you thoroughly check that you downloaded the correct app from Apple store? While it's rare, sometimes malicious apps can sneak into Apple store, too. Apple store verifications are not without errors and oversights.

How did you enter your wallet recovery words on your iPhone? Carefully typing by hand (assuming the keyboard app is safe) from an analog source or did you use some copy/paste actions from a digital source?

There's a lot that can go wrong if you're not aware of pitfalls and your descriptions lacks quite some details to judge what might have gone wrong. To be clear: I don't want to defend Atomic Wallet in any way. They brushed away valid security concerns of their product from past audit(s) without addressing them properly. I'm not convinced that Atomic Wallet knows what they're doing with their complex product.

[Z-tight]

I was one of those hacked. I always use atomic wallet on a dedicated laptop that is not used for anything else other than a wallet. I couldn't get my EOS to send, so support recommended I download the wallet to another device and I did, to my cell phone on May 31, from the Apple store. I believe that my account was compromised when I entered the seed phrase on  my Iphone. What do you think?

Sorry for your loss, but downloading the same Atomic Wallet software into another device couldn't have helped to protect you, that is because with the number of Atomic Wallet users who had their wallets compromised, it surely wasn't a local issue, but one that was wrong with the Atomic wallet software.

You should have used your seed phrase to import your wallet into a recommended software like Electrum, and send your funds immediately into another wallet with an Electrum seed phrase. It is going to be difficult to know exactly why you were hacked because even Atomic Wallet haven't provided an update on what caused the multiple attacks to their customers. Don't use closed source wallets, use open source wallets like Electrum, Sparrow or BlueWallet, or open source hardware wallets like Passport to store your funds.

[logfiles]

I was one of those hacked. I always use atomic wallet on a dedicated laptop that is not used for anything else other than a wallet. I couldn't get my EOS to send, so support recommended I download the wallet to another device and I did, to my cell phone on May 31, from the Apple store. I believe that my account was compromised when I entered the seed phrase on  my Iphone. What do you think?

Very likely, though not conclusive.

This particular issue involved lots of innocent users, and the team behind atomic wallet have not yet given any clear explanation about the exploit.

Just did a quick look around, has there been ANY update anywhere on this?

At this point they are not ever going to be considered secure again, but they seem to have just stopped mentioning it and as far as I can tell so have a lot of the online places that I read

They were never secure in the first place (in regard to not having an open source code)  

Pretty messed up wallet and the team behind it. I would treat it the same as a centralized exchange or a service that has already been completely compromised.

[sheenshane]

I would treat it the same as a centralized exchange or a service that has already been completely compromised.

Exactly, I saw a lot of complaints regarding this Atomic wallet the same on this thread which you also commented on those links of hacked issues.

What do you think?  
The hacked activities were made by their team who is behind on this major issue?  (because I'm thinking this way)
Newbies should stay away from this wallet since there are a lot of issues and it's not completely open source.

[Z-tight]

The hacked activities were made by their team who is behind on this major issue?  (because I'm thinking this way)

We can only speculate, but from what i have read about the hack, many people are suspecting this to be what happened, it was probably an inside job, maybe someone in their team added something malicious to their code, but until Atomic Wallet tells us what happened, we can only speculate, that's why closed source wallets aren't good.

Newbies should stay away from this wallet since there are a lot of issues and it's not completely open source.

Newbies should not only stay away from Atomic Wallet, but all closed source wallets, like Trust Wallet, the victims this time is users of Atomic Wallet, but who knows the closed source wallet that is next.

[BlackHatCoiner]

I would treat it the same as a centralized exchange or a service that has already been completely compromised.

I'd actually trust a centralized exchange more than that. At least if you register on some popular, regulated exchange you know that you're sending your coins to some licensed company. Sure, it can go bankrupt or/and hacked, but at least you know it isn't your fault. There is no way to know with certainty you made some mistake here during wallet creation. The software is closed-source; the developers can rip you off, blame it to you, and you could have nothing to say in your defense.

[RickDeckard]

After a small hiatus from my side, I remembered to check back on this event for any updates - It didn't come as a surprise but it has been now 3 months after the drainage of millions of users assets and no kind of update has been given to them (other than the one made 06/20[1]) by Atomic Wallet. Plus, their users are still being silenced by the company[2]. For anyone still thinking in using this service - don't do it if you care for your assets.
[1]https://atomicwallet.io/blog/june-3rd-event-statement
[2]https://libreddit.pussthecat.org/user/atomicwallet