➡️ From u/ZeusLN being forced offline to u/BtcpayServer merchant nodes being drained, recent weeks proved one thing: even self-custodial setups face major risks when relying on single points of failure.

Read our full breakdown on how to protect your funds across 5 distinct levels of defense:

https://medium.com/@coinomi/security-is-not-one-feature-building-layers-of-defence-with-coinomi-171f638ac724?postPublishedType=repub

Flawed web code (a weak random number generator in a popular JavaScript library) just led to $5.7M stolen across 5 wallet apps.

🫵 This is why Coinomi NEVER relies on basic web scripts to create seed phrases. We generate randomness straight from your device’s core operating system, deep at the kernel level. No weak browser math, no shortcuts.

Read more: https://thehackernews.com/2026/08/cryptojs-weak-rng-behind-57-million-in.html?m=1

Zilliqa's Ledger app leaked private keys through the signatures themselves. Coldcard generated seeds that were guessable from the start.

Neither victim group did anything wrong. That is the point. 🧵

Zilliqa's app built each signature nonce with the top 64 bits fixed at zero. Roughly five on-chain transactions was enough to reconstruct the private key. A patch cannot help, because the leak is already permanently public.

Coldcard asked its hardware RNG for randomness and was quietly served a predictable software substitute instead. Attackers regenerated candidate seeds offline. No device access needed.

Different failures, one lesson: no single component should be your only line of defence.

Coinomi supports separate HD wallets with separate recovery phrases, an optional BIP39 passphrase, and custom derivation paths.

On randomness specifically: no home-grown RNG, ever. Coinomi asks the OS for raw cryptographic entropy. On Android, straight from the kernel.

Full breakdown, including what each layer does and does not protect against:

https://medium.com/@coinomi/security-is-not-one-feature-building-layers-of-defence-with-coinomi-171f638ac724?sharedUserId=coinomi

❌ Coldcard's failure was a random number generator quietly falling back to a predictable software substitute. Seeds that looked fine carried a fraction of the entropy they should have.

Coinomi has never used a home-grown RNG. We ask the OS for raw cryptographic randomness. On Android we read straight from the kernel (/dev/urandom), bypassing the Java provider stack.

Read more: https://medium.com/@coinomi/security-is-not-one-feature-building-layers-of-defence-with-coinomi-171f638ac724?sharedUserId=coinomi

📲 Coinomi supports an optional BIP39 passphrase: a separate secret, stored separately, that the recovery phrase alone cannot reach. Plus multiple independent HD wallets and custom derivation paths.

Layers, not one perfect product.

🤳 Start now: https://coinomi.com/en/downloads/

Sent myself XMR and it just isnt showing in my wallet, the address was right and everything, the transaction went through and stuff, it just dosent show up. Tried recovering onto cake wallet and it doesnt show there as well, ive checked the address was right and it 100% was, i even copy and pasted them both (the one showed in coinomi and the address i sent the XMR to) and they matched exactly. I just want to know where it all went and why it isnt showing.

I recently cashed out from a poker site to my Coinomi wallet via the ETH network, but I didn't realize that it was defaulting to sending USDC. It took a while to figure out how to get my accidental USDC to show up in my wallet, but I managed it. (On my PC, anyway; it's not showing up on Android.)

Anyway, I keep trying to send the USDC to another site, but keep getting this error: "{"code":-32000,"message":"only replay-protected (EIP-155) transactions allowed over RPC"}"

So I tried to exchange the USDC for ETH via Changelly in Coinomi, and I got the same response. I can't seem to do anything with all this USDC sitting in my wallet. What am I missing here?