Coinomi might also have an issue similar to Coldcard.

[I4BTC]

Hello. I hope you and your Bitcoin holdings are doing well. I came across this site a few years ago:
https://www.avoid-coinomi.com/

I have truly never felt such a sense of empathy before; it is heartbreaking. The whole Coldcard saga is terrible.

I try to keep up with the news via Google, but I’m asking just to be sure:
What is the latest news regarding the Coldcard hack? Has the company announced that they will cover the losses? Has the thief been caught?
I suspect the thief is either an insider at the company or someone opposed to Bitcoin.
What is your prediction? What will become of the Coldcard company and the thief?
All in all, damn that scumbag. Even though I didn't use Coldcard myself, I feel a profound sense of empathy.

[BitMaxz]

Coinomi is known as a wallet that supports many coins and tokens since before.
But the problem is this is not a smart choice because there are many users already being hacked and stolen funds using this wallet. This kind of wallet must be avoid for now we can't trust any wallet the better choice is to use a wallet that is provided by the developer of the coin/token or old wallets that can be run offline/cold storage rather than using any hardware wallet because remember how the firmware or OTA updates infected us? We can't trust a hardware wallet that keeps having OTA updates that could lead to vulnerabilities.

If you only hold BTC, you can use Electrum as a cold storage wallet but if you are holding many coins and tokens, you don't have another choice but to use hardware wallet that supports multiple coins/token.

About the cold card case, no one knows if this is an inside job or not, but every cycle we always hear similar cases, even exchanges like Bitget, that look like inside jobs too to manipulate the BTC price.

[ABCbits]

What is the latest news regarding the Coldcard hack?

A "whitehat" take 52 Bitcoin from vulnerable address and claim the victim can fill some form to recover their Bitcoin[1].

Has the company announced that they will cover the losses?

No, i don't expect they'll ever do that. Besides it could make them bankrupt, how would they can tell apart between real loss claim and fake loss claim?

Has the thief been caught?

No, but it's worth to mention there's claim FBI may know one of the thief[2].

[1] https://www.coindesk.com/markets/2026/09/22/whitehats-move-52-bitcoin-from-the-coldcard-hack-to-a-recovery-trust
[2] https://bitcoinmagazine.com/technical/hunting-down-the-coldcard-hacker-wave-1-thief-may-be-known-to-fbi

[NotATether]

Coldcard is not going anywhere (unfortunately).

The right thing for this company to do would be to shut down after such a catastrophic breach and loss of trust, but nvk seems to think he can somehow gain the community's trust back.

Anyway, I haven't heard about what is happening to Coinomi. Are people saying it has another entropy (weak seed phrases) bug?

[coinlary]

Coldcard is not going anywhere (unfortunately).
-snip-
but nvk seems to think he can somehow gain the community's trust back.

How though?

The only possible way I can think of is if they can find a means to pay back 90% if not 100% of the total victims of their hack, and I highly doubt they can even do any of it.

Even if they do, no one in their right senses who experienced such a loss and managed to get it back miraculously or heard of it, would think of continuing to hold on to Coldcard, and that's if they're still going to be interested in holding anything.

[notocactus]

What is the latest news regarding the Coldcard hack? Has the company announced that they will cover the losses? Has the thief been caught?

You can follow it up with this thread in the forum because the community will keep you updated there.
Large-scale Coldcard compromise (1596 BTC stolen so far).

Coinomi is known as a wallet that supports many coins and tokens since before.

I never use a multi coin wallet to store my bitcoin in a same wallet. It's too risky.
If I use a multicoin wallet, I use it for storing altcoins, while with my bitcoins I store it in another wallet that is a Bitcoin-only wallet by design and program technically.
Coinomi wallet is also close source, it's another risk.
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=coinomi

[logfiles]

I wouldn't be surprised if some vulnerability or hack was discovered on coinomi based on the past incidents. The wallet software being closed sourced makes us not to know what is even going on behind the scenes and this is one of the reasons I avoided using such a wallet.
It's kind of similar to what happened to Atomic wallet where we had no idea what really happened behind the scenes but people lost money.

[pooya87]

I suspect the thief is either an insider at the company or someone opposed to Bitcoin.

Not necessarily. The culprit might have just found a vulnerability and took advantage of it to commit a crime (ie. theft). They don't have to an insider to find a vulnerability, and they definitely don't have to oppose or support bitcoin!

As for Coinomi, it is best to stay away from closed source applications. They don't have to be malicious themselves, but it may contain serious vulnerabilities and you would be putting all your trust into their abilities and they don't give you any kind of guarantee in return.

People should stick to popular bitcoin wallets like bitcoin core or electrum to store their bitcoins.
And for altcoins, they should stick to popular wallets and if multi-coin wallets is what they seek (they should still use core or electrum for bitcoin) they should seek open source and reliable software. I personally like Cake wallet these days. It is open source and has an active developers team. Here is its topic: https://bitcointalk.org/index.php?topic=5545396.0

[Ambatman]

The truth still remains no matter the outcry or education
Some people would still make use of close sourced wallet if they believe it's convenience
Likewise centralised exchanges in holding their coins.
Despite what happened with coldcard
If they are able to turn things a little around people would still make use of it
Take for example ledger despite the breaches people still make use of it.

What is your prediction? What will become of the Coldcard company and the thief?

They would continue to operate but I expect some lawsuit against them maybe on negligence
Since the fault wasn't really from the users end
Well The thief has already started moving the funds in batches.
https://www.theblock.co/news/defi/2026-09-07-coldcard-exploiter-moves-wave-3-413661?utm_source=chatgpt.com

[DaveF]

The Coinomi thing has been around and dismissed for years. But no large scale compromise. If there was one it would have been for a lot more funds.
Coinomi has been around for a long long time with a lot of users. A few people who lost funds really points to user error.
Not victim blaming, just looking at the facts.

-Dave

[BitMaxz]

I never use a multi coin wallet to store my bitcoin in a same wallet. It's too risky.
If I use a multicoin wallet, I use it for storing altcoins, while with my bitcoins I store it in another wallet that is a Bitcoin-only wallet by design and program technically.
Coinomi wallet is also close source, it's another risk.
https://walletscrutiny.com/?platform=allPlatforms&page=0&query-string=coinomi

Well, I used them before I still had the backup seed because I still had a few Sats and other coins there, but I already uninstalled Coinomi. I know many people are already being hacked from Coinomi wallets, which is a sign that this wallet is no longer safe.

It seems only airgap.it is the best one for me with open-source code as an alternative for this, and the good thing is you can separate your wallet that keeps your keys offline and watch-only wallet. The only problem is it only has limited supported coins, and I hope they can add more.

[FinneysTrueVision]

Coinomi is closed source and its developers had stopped maintaining it for several years, which meant that users lost access to their funds for some time on certain blockchains. There was a lot of complaints about users' transactions on Monero not showing up and they also couldn’t figure out how to restore their wallet in a different application. Their development eventually resumed, but I still wouldn’t trust them after that incident where private seeds were being sent to Google.

[Cricktor]

It seems only airgap.it is the best one for me with open-source code as an alternative for this, and the good thing is you can separate your wallet that keeps your keys offline and watch-only wallet. The only problem is it only has limited supported coins, and I hope they can add more.

An airgapped setup doesn't save your wallet's coins when weak and/or flawed entropy was used by your wallet for whatever reasons!

Weak entropy means there's a feasible attack possible for someone else to brute-force your seed because the search space is drastically lowered to such an extend that an attack is doable. This is what happened with the debacle of flawed Coldcard firmware.

If someone can brute-force your seed because your wallet generated very weak entropy due to very flawed RNG or other severe issues, then it doesn't matter if your wallet is airgapped or not.

So, I don't quite understand what you're trying to say in the beginning of the cited portion.

I would generally stay away from closed-source wallets because without reverse-engineering the binary executable you have no way to see if this wallet handles the important stuff properly and doesn't screw up the security of your keys and coins.

[PX-Z]

It seems only airgap.it is the best one for me with open-source code as an alternative for this, and the good thing is you can separate your wallet that keeps your keys offline and watch-only wallet. The only problem is it only has limited supported coins, and I hope they can add more.

An airgapped setup doesn't save your wallet's coins when weak and/or flawed entropy was used by your wallet for whatever reasons!

Weak entropy means there's a feasible attack possible for someone else to brute-force your seed because the search space is drastically lowered to such an extend that an attack is doable. This is what happened with the debacle of flawed Coldcard firmware.

If someone can brute-force your seed because your wallet generated very weak entropy due to very flawed RNG or other severe issues, then it doesn't matter if your wallet is airgapped or not.

So, I don't quite understand what you're trying to say in the beginning of the cited portion.

I would generally stay away from closed-source wallets because without reverse-engineering the binary executable you have no way to see if this wallet handles the important stuff properly and doesn't screw up the security of your keys and coins.

I think you're addressing a different security aspect from what you have quoted/ was saying.

Nobody said an air gapped wallet can protect against weak entropy. If the wallet generates a predictable seed because of a flawed RNG or implementation, then obviously keeping it offline doesn't magically make that seed secure.

The point is, about key isolation, keeping the wallet that holds the private keys offline while using a separate watch only wallet for monitoring and of course, transaction preparation. Also, that's an additional security layer against online attacks and malware, not a solution for bad entropy. From what i had keep reading from BitMaxz, he is most probably using electrum, so addressing entropy aspect is pointless since electrum is known for having good entropy.

[BitMaxz]

I think you're addressing a different security aspect from what you have quoted/ was saying.

Nobody said an air gapped wallet can protect against weak entropy. If the wallet generates a predictable seed because of a flawed RNG or implementation, then obviously keeping it offline doesn't magically make that seed secure.

The point is, about key isolation, keeping the wallet that holds the private keys offline while using a separate watch only wallet for monitoring and of course, transaction preparation. Also, that's an additional security layer against online attacks and malware, not a solution for bad entropy. From what i had keep reading from BitMaxz, he is most probably using electrum, so addressing entropy aspect is pointless since electrum is known for having good entropy.

Like I said, it's an alternative that supports multicoin; it's not far from what I replied because the Coinomi wallet also supports multiple coins.  

About the entropy, the randomness seed generation from this wallet compared to Coinomi or RNG is totally different; you can even generate a seed via dice through this guide here https://support.airgap.it/guides/coin-flip-dice-roll-entropy-collection/

I know how good Electrum is, but Airgap is also a good sample too about RNG and how they generate wallet seeds, and they keep suggesting you to add an extra word or a passphrase to protect your wallet if ever the hackers brute-force and predict the wallet generation but I think it's impossible because they recommend you generate a wallet through Dice Roll or Coin Flip. It also relies on your device hardware components and OS.