SecondFi Assistance Team @secondfiappAT

Hello @73trinhh we apologize for the inconvenience this might have caused you, kindly send us a direct message and a team member will assist you accordingly. Best regards

Mai Trinh @73trinhh

19 hours ago

@secondfiapp Làm ơn nhanh dùm tôi, 2 ví của tôi bị ảnh hường, bây giờ tôi phải làm sao. Tôi cần tiền để đóng lãi ngân hàng.

18 0 12 516 0

Hello @ferraroffb we apologize for the inconvenience that might have caused you, kindly send us a direct message and a team member will assist you with asset recovery process accordingly. Best regards

FFB @ferraroffb

17 hours ago

@secondfiapp @secondfiapp My coins simply vanished, and the app states that the wallet was affected. Will all assets be restored through this secure recovery process?

33 1 10 370 0

Your Options for Securing Assets, and What’s Next We recognize that some users may not have completed all steps in the Hardware Wallet Guidance posted in our knowledge base. If you are not technically proficient, we recommend waiting for the secure wallet export functionality, which is currently intended to launch next week. Here is an update on upcoming options: • This week: Quarantine mode We will enable quarantine mode, which will let users check whether a wallet address appears in preliminary incident-related data and submit a support ticket with the relevant wallet address. • Next week: Secure wallet export functionality We intend to deploy secure wallet export as the next phase of quarantine mode. This is intended to provide a safer way for users of varying experience levels to move assets to a new wallet. • On potential asset recovery As stated previously, we intend to support a process relating to potential asset recovery for users whose wallets are confirmed through the applicable process. Any such process remains subject to further investigation, verification, eligibility criteria, applicable terms and conditions, and technical implementation. It is currently expected to involve a recovery tool using zero-knowledge proofs, initiated by users through a portal, designed to help users remain in control of the process while protecting their information. Again, if you are not technically proficient, we recommend waiting for these options to go live. For now, you may submit a ticket at support.secondfi.io. We will continue sharing updates as progress is made.

Hardware Wallet Migration Guide We have published a step-by-step guide to help users securely move their assets to a new hardware wallet, the most secure option for self-custody. Before you start, keep these in mind: - If you already use a hardware wallet, no action is required. Hardware wallet users were not affected by this incident. - Do not delete the SecondFi app, and keep your seed phrase safe. Either one will be required to claim your assets through the recovery process. - Stop using your existing wallet. Do not send, receive, sign, or stake from it. The full step-by-step guide, including how to test with a small amount before moving your balance, is available here: kb.secondfi.io/en/article/har… Important Security Reminder SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. We will never DM you first. Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent. Our official channels are @secondfiapp, @secondfi_jp, and support.secondfi.io. For support, please submit a ticket only through our official support channel at: support.secondfi.io

Please be vigilant. This is a scam. SecondFi has NOT released a desktop app or any downloadable recovery software. Do not download anything claiming to be SecondFi. Do not "reclaim" assets through any app or link sent by email. Important Security Reminder: SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. These are the ONLY OFFICIAL SecondFi channels: ▪️ X accounts @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io We will never DM you first. Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent.

🪏 Jonah Koch @jonahkoch

2 weeks ago

Watch out fam, I got two more of these phishing emails today. One from "CF" one from "SecondFi"

keyboard_arrow_left Previous keyboard_arrow_right Next

1 6 11 13K 0

⚠️ IMPORTANT SECURITY REMINDER These are the ONLY OFFICIAL SecondFi channels: ▪️ X accounts @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io We will never DM you first or ask for your recovery phrase. Any other account is a scam account. If you come across a fake account or suspicious message, please report it to X. The screenshots below show known impersonator accounts to watch for. Stay alert, and only trust updates from our official channels.

keyboard_arrow_left Previous keyboard_arrow_right Next

🛡 Recovery Process Update Today, we want to share an update across three areas: ⚙️ Returning user assets ⚙️ Moving user assets safely ⚙️ Onchain recovery 1. Returning User Assets - Drained by the attackers: @emurgo_io has funded an Asset Recovery Wallet specifically to return assets to users whose wallets were compromised in the attack. - Secured through our emergency rescue response: These assets are currently protected and accessible. We are in discussion with @IntersectMBO on the appropriate custody mechanism to ensure they are held securely and returned to users. 2. Moving Your Assets Our initial guidance was to stay put which was a deliberate step while we worked to fully understand the attack vector and avoid exposing users to further risk. Following active discussions with the Intersect Security Council, should you decide to move your assets, we recommend creating a new wallet using a hardware wallet only. A hardware wallet is the most secure option available. Important: However, users should NOT delete the SecondFi app under any circumstances. We strongly advise users to retain BOTH the app and their seed phrase, as they will be required to support the asset recovery process currently underway. 3. Onchain Recovery Our team is actively progressing an on-chain recovery solution designed to support the secure return of user assets. Extensive technical assessment has identified this as the most secure and efficient recovery pathway currently available. We are now working closely with a Cardano community-led task force to develop, validate and execute this solution securely. This process is more complex than originally anticipated and may require additional time beyond our previously estimated 2-week timeline. We will continue providing updates as progress continues. Important Security Reminder: SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. We will never DM you first. Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent. Our official channels are our verified SecondFi X account and support.secondfi.io. For support, please submit a ticket only through our official support channel at: support.secondfi.io Thank you for your continued trust as this work continues.

🛡 Recovery Process Status The team remains on track against the estimated 2-week recovery timeline, with substantial progress continuing as engineering teams work through multiple technical approaches in parallel to determine the most secure recovery solution for affected users. What Comes Next: To help users safely prepare for the upcoming next steps, we will be releasing: 1. A suitable mechanism that will allow users to check whether their wallet has been affected by early next week 2. A secure process that will allow users to safely move assets out of the platform thereafter. Our commitment remains unchanged: protecting users and ensuring assets are returned securely. Important Security Reminder: At this stage, NO recovery actions requiring user participation have begun. Until official instructions are provided, wallets should remain untouched and users should continue to rely only on updates shared through official SecondFi channels. SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. Should you have any questions, please submit a ticket only through our official support channel at: support.secondfi.io We remain fully committed to completing this process safely and responsibly, and thank you for your continued support.

⚠️ Important Security Update We are seeing an increase in malicious activity and impersonation attempts related to the recent incident. As a precaution, please DO NOT deposit any additional funds into your existing SecondFi wallet until further notice. To help users safely navigate next steps, we will be releasing: 1. A suitable mechanism to allow users to check whether their wallet has been affected by early next week. 2. A secure process that will allow users to safely move assets out of the platform thereafter thereafter. Please remember that NO recovery actions require user participation have begun at this stage. Wallets should remain untouched until official recovery instructions are provided. SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. For support, please submit a ticket only through our official support channel at: support.secondfi.io Thank you to everyone for your continued patience and trust as this work continues.

⚠️ Important Security Advisory: Scam Attempts We have identified fraudulent messages circulating online from malicious actors attempting to impersonate SecondFi while our incident response remains underway. Please note that NO recovery actions requiring user participation have begun at this time. SecondFi will NEVER request private keys, seed phrases, wallet credentials, or direct wallet access under any circumstances. Any communication instructing users to submit wallet information, migrate assets, or take immediate action outside of our verified official SecondFi channels should be considered fraudulent. NO user action is required at this stage. You may submit a ticket through our official support channel at: support.secondfi.io Our team is actively monitoring these malicious activities alongside our ongoing recovery progress, and we will continue sharing verified updates as progress continues.

🛡️ Recovery Process Update Our team remains focused on returning assets to affected users, and we are making strong progress on a structured recovery and verification process. Two important updates today: 1. The final balance snapshot has been taken today, Friday 26 June 2026. We have been capturing regular snapshots throughout the incident response, and this final one gives us an accurate, verified record of balances to work from as we prepare recovery. 2. Timing of recovery. Behind the scenes, our engineering and security teams have worked around the clock to validate balances and evaluate recovery mechanisms. This has led to a solution where assets can begin being returned, which we estimate is around two weeks away: roughly one week to reach a working solution, then a week of testing and review. Timing may shift as the work continues but our priority is clear: a safe return of funds and getting SecondFi back online responsibly. We will resume operations once we are fully confident the platform is secure and all security reviews are complete and we are determined to get there as quickly as we safely can. For now, the only action required is to submit a support ticket at: support.secondfi.io. We appreciate your continued patience as we work through this process responsibly and will continue sharing updates as progress is made.

📢 Important Guidance for SecondFi Users We understand that many users are considering migrating to new wallets, and that trusted members of the Cardano community are suggesting ways to do so. We recognise this comes from a desire to protect your assets. If you choose to migrate, you do so at your own risk. However, we strongly advise against taking this action at this time. Particularly if you are not technical, the safest course is to leave it untouched. Independent actions taken outside of official guidance create additional risks, and may significantly complicate the asset claims process. Our team is working through a secure recovery process, and we will continue keeping users updated as progress is made. Official step by step instructions will follow shortly. If you have a query, you may submit a ticket at: support.secondfi.io. We will never DM you first or ask for your recovery phrase. Thank you for your patience.

We aim to provide the latest update on our investigation into the exploit As mentioned in our previous post, between June 21–23, 2026, a sophisticated, automated attack drained funds from multiple Cardano wallets. We now have identified and isolated the addresses of 2 attackers. We are sharing them below with the community, for full transparency. Attacker A (Waves 1 & 2) Drained 171 wallets across two automated batches. • Collection Wallet 1: addr1q9j7f598x988unr4zhjulft205jqnn9ewgwkhes5smf2sr6jsw98nm4qq38jw9epe587twavuhuhj5d8r92rjvmyjlzs9lqc3x • Collection Wallet 2: addr1q9wudkfeelzwev427yvapkmqexmet8q4vl303m7a4eerwtvt6rq00zyuqzeuw759vgqtdky0gyxnqx27n8q4k6h79yhsqelma8 • Collection Wallet 3: addr1q82jlp2u0ezv2hsf6f40fkrv49hd72yv442nmrr5qeultpqamepaykp3m564hnd4zp75wxxds2j6d3ywvc8prhf2kcxqn6nql3 • Central Fee/Change Address: addr1q8acx4h5a38x6ekpsp0x7aelw6mflt78khmz8lz75rtnqvn07w88zx2e89tgzqr3x0mecngqlg87kq9surhk48hj79mqcezfa8 • Attacker Stake Key: Stake1u9hl8rn3r9vnj45pqpcn8auuf5q05rltqzcwpmm2nme0zasf40ymg Attacker B (Wave 3) Drained 203 wallets in a separate automated sweep. • Collection Wallet (⚠️ 4,020,468 ADA linked to the exploit remains in this address, which has been flagged and is under active monitoring and investigation): •addr1q8m5wdncq7rwum73r5cyyr82qx2xjem5k4ehapl3wy36aaerj829vasl3amtcwshgvnn6a25dr850tfw6qaj420d2szsslkku6 • Attacker Stake Key: stake1uy3er4zkwc0c7a4u8gt5xfeaw42x3n6845hdqwe248k4gpgdq4da5

Our commitment to supporting affected users remains unchanged. We are continuing to work alongside law enforcement agencies and key partners across the Cardano ecosystem to trace and restrict the movement of assets linked to the attack. As investigations continue, we are actively reviewing all relevant intelligence related to the attack and the individuals responsible. Credible information relevant to the incident can be directed to [email protected] We will continue providing transparent updates until every necessary step has been completed.

twitch.tv/bollefromdk

@FrimannFNBR Tillykke unc

@TrypFNBR Køb såfan en her

@TrypFNBR Jeg er broke

@TrypFNBR Så lad være med at skrive benz når det er diesel🤪