COINOMI

DESCRIPTION OF EVENTS

"According to Al Maawali, he downloaded the Coinomi wallet on February 14th 2019 and noticed that while the installer file was digitally signed, the resulting installed Windows application was not. He reported this to Coinomi (who have since added the signature) and nevertheless opted to use the application based on his trust in ‘several reputable websites’ that mention Coinomi and entered the seed phrase of his Exodus wallet into Coinomi to access the associated addresses."

"On February 22nd 2019, assets from cryptocurrency wallets associated with Al Maawali’s seed phrase were observed to have been transferred elsewhere. Al Maawali discovered that when a user of the Coinomi desktop wallet enters a seed phrase for wallet recovery, the app sent the text of that seed phrase to the Google API for spell-checking, and claims that this was the cause of his loss of funds. Coinomi acknowledges that the version of the wallet installed by Al Maawali had that feature (which has since been removed), but points out that (i) the seed phrase was sent encrypted via an HTTPS connection and (ii) Google’s API rejected the request as ill-formed for lack of an API key. Al Maawali’s contention is therefore that (i) Google stores information about such rejected API requests and that (ii) someone at Google must have had access to these records and recognized a 12-word seed phrase among them, which they then exploited to steal his funds."

"Multiple deposits via single-use intermediate wallets to 0xfde0e8207f0d29a659f318ffc0fa3e3eb1b4341a, which by all appearances belongs to a service that itself uses Binance with a deposit address at 0xe460167a64abc859869cc037caee2a3ab0ebfe70. There are further deposits via single-use intermediary wallets (likely belonging to the same service) to the same Binance address coming from the Consolidation Wallet. The same service also uses Huobi with a deposit address 0xbfc8a7da31c82a8a53ca34ae7969b8fbbe6bf86d."

"Note that none of these exchange accounts necessarily belong to the hacker, and some of them clearly don’t. Nonetheless, they provide a strong point of attack, and as investigators, we would immediately lay out this situation to law enforcement and ask for them to contact these exchanges to acquire information about the owners of these accounts, who are either suspects or services that the hacker used and that may have information about him or her."

"Upon review of the publicly available facts, it quickly became apparent to the CipherBlade team that Al Maawali’s conduct is grossly inappropriate to the situation. We receive multiple messages on a daily basis from people seeking help regarding scams or hacks, and so we understand very well that victims can be emotional and even irrational — in the worst case yet, we’ve been forced to prevent a fraud victim from attempting to murder a suspect. And indeed, even well-composed individuals are often at a loss as to what the proper course of action is when they become the victims of such crimes. Nevertheless, given the public nature of the present incident, it is worthwhile using it as a case study."

Warith Al Maawali claimed that his Coinomi wallet was compromised and funds stolen due to a vulnerability in the wallet app. He demanded compensation from Coinomi and launched a public campaign against them. Al Maawali alleged that a missing digital signature in the Coinomi app caused his loss. He also claimed that his seed phrase was sent to Google's API, leading to the theft. Blockchain forensics showed that multiple victims' funds were being consolidated in hacker-controlled wallets, indicating malware or phishing. CipherBlade challenged Al Maawali to provide evidence of contacting authorities and offered assistance to expedite investigations.

Crypto investor Claims He Got Stolen with $70K In Coinomi - Cryptimi (Oct 14)
https://medium.com/@cipherblade/how-not-to-react-when-your-cryptocurrency-is-stolen-92f7c72616af (Aug 18)
f7ddfd505a comments on Crypto investor Claims He Got Stolen with $70K In Coinomi (Aug 18)
Reddit - Dive into anything (Aug 18)
f7ddfd505a comments on SECURITY VULNERABILITY Coinomi wallet sends your plain text seed phrase to Googles remote spellchecker API when you enter it! (Aug 18)
f7ddfd505a comments on SECURITY VULNERABILITY Coinomi wallet sends your plain text seed phrase to Googles remote spellchecker API when you enter it! (Aug 18)

More case studies

Ledger Wallet
Theft rasgun66

DragonEx
Hacking Theft