Coinos on Nostr: We're still investigating what happened here. It seems a handful of accounts may have ...
We're still investigating what happened here. It seems a handful of accounts may have been compromised and had their autowithdrawal settings tampered with, including our own "coinos@coinos.io" account.
We ran a script to search for accounts that had the attacker's "speed.app" withdrawal address in place and found about 9 that seem to have been affected. There could be more though, we will update as we have more information.
I worry that this may be the same attacker who exploited a password reset vulnerability back in January which allowed them to gain access to a number of accounts. It's possible that since that time they have been sitting on the account data and working to brute force the encrypted nostr private keys that we had on file for some accounts that had imported their nostr key into Coinos. Those keys were encrypted at rest in our database but it's possible they may have been cracked.
We no longer store nostr private keys for accounts and have since added support for external signing apps and browser extension login, but there was a time when we were storing encrypted nsec private keys.
Having a users nsec would allow an attacker to authenticate into Coinos by signing a nostr event and change the user settings. It also means your entire nostr profile and identity may be compromised.
This is only a hypothesis at this point and we need to investigate further but we may end up recommending that affected users rotate their nostr keys.
PSA: An autowithdraw exploit for Coinos (npub1h2q…w8ch) has been confirmed. Check your settings if you’re using this wallet.
Felt bad for not giving them more time to respond privately, but hopefully this saves some of your sats.
note1254…d74m
Published at
2025-06-08 23:47:16Event JSON
{
"id": "9820fe3f0bfe315036f44edc921d4415fab41b521e72be74e655a9b0b233ba29",
"pubkey": "ba80990666ef0b6f4ba5059347beb13242921e54669e680064ca755256a1e3a6",
"created_at": 1749426436,
"kind": 1,
"tags": [
[
"q",
"da63ce419b19cfa710001bee36bee3b4d98bf5ec53b80fa9805e35e4a9516f4e",
"wss://nos.lol/",
"a10260a2aa2f092d85e2c0b82e95eac5f8c60ea19c68e4898719b58ccaa23e3e"
],
[
"client",
"noStrudel",
"31990:266815e0c9210dfa324c6cba3573b14bee49da4209a9456f9484e5106cd408a5:1686066542546"
]
],
"content": "We're still investigating what happened here. It seems a handful of accounts may have been compromised and had their autowithdrawal settings tampered with, including our own \"coinos@coinos.io\" account.\n\nWe ran a script to search for accounts that had the attacker's \"speed.app\" withdrawal address in place and found about 9 that seem to have been affected. There could be more though, we will update as we have more information.\n\nI worry that this may be the same attacker who exploited a password reset vulnerability back in January which allowed them to gain access to a number of accounts. It's possible that since that time they have been sitting on the account data and working to brute force the encrypted nostr private keys that we had on file for some accounts that had imported their nostr key into Coinos. Those keys were encrypted at rest in our database but it's possible they may have been cracked.\n\nWe no longer store nostr private keys for accounts and have since added support for external signing apps and browser extension login, but there was a time when we were storing encrypted nsec private keys.\n\nHaving a users nsec would allow an attacker to authenticate into Coinos by signing a nostr event and change the user settings. It also means your entire nostr profile and identity may be compromised.\n\nThis is only a hypothesis at this point and we need to investigate further but we may end up recommending that affected users rotate their nostr keys.\n\nnostr:nevent1qvzqqqqqqypzpggzvz325tcf9kz79s9c9627430ccc82r8rgujycwxd43n92y037qy88wumn8ghj7mn0wvhxcmmv9uq32amnwvaz7tmjv4kxz7fwv3sk6atn9e5k7tcqyrdx8njpnvvulfcsqqd7ud47uw6dnzl4a3fmsrafsp0rte9f29h5uxpgg73",
"sig": "33e09842ccb271b6ff7875810289fcda4ad5435f2c03f205d79095d0994313933c9a5bf3d7c882a3f85c53f2f019cf3e4a7a668bc7df3b47e4b1169f664bd380"
}
