A Coinomi recovery phrase is normally 24 words, follows the BIP-39 standard, and controls every coin that wallet has ever held. Plenty of people set Coinomi up years ago, drifted to other apps, and still have those words folded into a drawer or saved in a note somewhere. If that sounds like you, two questions are worth answering before you touch anything: what those words can still open, and why one incident from 2019 should change how you handle them.
Coinomi launched in 2014 and is among the oldest wallets still being maintained. Its draw was breadth, with hundreds of assets in a single app and no account or identity check to get started. That same breadth explains why so many dormant Coinomi wallets are still out there, holding odd amounts of coins their owners have half-forgotten about.
What the words are, and what they open
The phrase is a seed phrase in the BIP-39 format, which means it encodes the master key that every address in your wallet is derived from. Coinomi documents support for an optional BIP-39 passphrase layered on top: a separate secret that produces an entirely different set of wallets from the same 24 words. Anyone who set one of those up and then forgot about it will restore an empty wallet and assume the words are wrong, which is one of the more common ways this goes sideways.
Because BIP-39 is a published standard rather than a Coinomi invention, the phrase travels. You can import it into other wallets that implement the same standard, and your funds do not depend on Coinomi continuing to exist. The catch is that wallets differ in the derivation paths they scan, so a correct phrase can still show a zero balance in a new app until the right path is used. A zero balance on first import is usually a path problem rather than a lost wallet.
Your Coinomi recovery phrase and the 2019 spellcheck bug
In February 2019, a Coinomi user found that the desktop app's restore screen had been sending recovery phrases to Google in plain text. The text box where you type your words ran through a spellchecking plug-in, and that plug-in forwarded its contents to googleapis.com for checking. Decrypt covered the dispute as it broke, and the user's own account of what happened puts his loss at 17 BTC, with the outgoing transfers starting on 19 February.
Coinomi confirmed the transmission and disputed the framing, saying the behaviour came from a third-party plug-in rather than from any deliberate design, that only the desktop build was affected, and that a fix shipped the same day the report reached them. The company also accused the user of attempting extortion, and the argument over who owed whom what never reached a tidy conclusion.
Strip away the blame and one lesson survives intact. Your words were exposed to a service nobody involved had thought about, through a component the wallet's own developers had not written, and the exposure happened during the one action that requires you to type all 24 words in sequence. A recovery phrase entered into software inherits the trust boundary of every library that software loads. That is the reason we designed TapSafe Recovery so the phrase is a last resort rather than a routine step, because words you never type are words no plug-in can forward.
What to do if you still have a Coinomi wallet
Start by finding out whether there is anything in it, and do that without typing your phrase into anything new. If you remember your receiving addresses, a block explorer will show you the balances without any wallet involved at all. Coinomi itself reports no successful breach of the wallet since the 2019 episode, so an untouched install is not an emergency, though a phrase that has passed through a desktop restore screen deserves to be treated as compromised.
If there are funds worth moving, the cleanest approach is to generate fresh keys on hardware and send the coins to the new addresses as an ordinary transaction. Importing the old phrase into a new device carries the old exposure with it, because the thing you are protecting is the phrase itself. Check which assets you hold first: Coinomi's asset list runs to hundreds of tokens, and no hardware wallet covers all of them.
Where your recovery should live instead
The standard answer to backup is twelve or twenty-four words on paper, and paper is the weakest object in the chain, since it tears, burns, fades, and gets thrown out by someone tidying up. Stamping the words into steel is a sensible upgrade because metal survives a house fire, and it leaves the deeper shape of the problem untouched. One object still reconstructs your whole wallet, and it has to stay both undamaged and unseen for as long as you hold crypto.
TapSafe Recovery was built to remove that dependency on a single item. We split recovery using our own implementation of Shamir's Secret Sharing: the Recovery Tag holds half, your paired phone holds the other half encrypted into your own iCloud or Google Drive rather than on the handset itself, and optional Recovery Contacts hold a quarter each while learning nothing about what you own. No single share opens the wallet, which turns losing a piece into a repair job. Your seed phrase stays readable on the device as a last resort and follows BIP-39, so you are never tied to our hardware any more than you were tied to Coinomi's.
Landing somewhere better than a drawer
An old Coinomi wallet is a useful prompt to ask where your keys should live now. Keys generated inside a dedicated chip have never been typed into a text box, never passed through a spellchecker, and cannot be read by code running on your laptop.
The Ryder One generates keys inside an EAL6+ certified Infineon SLC38 secure element and keeps them there. It talks over NFC only, with no Bluetooth radio, no Wi-Fi, and no data moving over a cable, so it is reachable when you tap it against your phone and at no other time. Every transaction renders in full on the 1.6-inch AMOLED touchscreen before you approve it, and Halborn published a full independent audit of the firmware. Supported assets are Bitcoin, Ethereum, Solana, and a growing list of top ERC-20 and SPL tokens.
Two things to know before you plan the move. Ryder One imports a standard 12 or 24-word BIP-39 phrase, and it does not support an additional BIP-39 passphrase, the one some wallets call a 25th word. If your Coinomi wallet leans on a passphrase, or on a derivation path outside the standard, treat importing as the wrong route and send the coins as an ordinary transaction to freshly generated keys. That is the advice above anyway, for reasons that have nothing to do with which hardware you buy.
The Starter Combo is 149 USD and the Super Safe Combo is 179 USD, both including the Recovery Tag, a wireless charger, and a pouch, with setup running about 60 seconds across three taps. Get your Ryder One.
Share: