> He argues that Coinomi’s built-in spell checker automatically checked his seed phrase which involved sending it as plain text to a Google-owned website. This meant it could have been intercepted, leading to the loss of funds.
"As plain text" here almost certainly means "fully encrypted with TLS"...
I think the argument though is that the request is being logged and that some employee is reviewing logs and grabbing data.
If that is the case, then it seems there is a known pool of suspects to charge with theft...
I'd wager there was just some malware on the machine.
The regex is so simple I think it a little naive not to assume _someone_ has a script running to sniff out keys. It would be trivial for an ISP employee to watch for such strings in unencrypted traffic streams. Think what cloudflare could find if they went looking.
I strongly suspect grepping against inbound production traffic to Google's spellcheck service is fairly difficult to do unnoticed.
Malware, on the other hand, is quite prevalent. Plenty of folks lose their crypto on a daily basis in that manner.