SecondFi

Your Options for Securing Assets, and What’s Next We recognize that some users may not have completed all steps in the Hardware Wallet Guidance posted in our knowledge base. If you are not technically proficient, we recommend waiting for the secure wallet export functionality, which is currently intended to launch next week. Here is an update on upcoming options: • This week: Quarantine mode We will enable quarantine mode, which will let users check whether a wallet address appears in preliminary incident-related data and submit a support ticket with the relevant wallet address. • Next week: Secure wallet export functionality We intend to deploy secure wallet export as the next phase of quarantine mode. This is intended to provide a safer way for users of varying experience levels to move assets to a new wallet. • On potential asset recovery As stated previously, we intend to support a process relating to potential asset recovery for users whose wallets are confirmed through the applicable process. Any such process remains subject to further investigation, verification, eligibility criteria, applicable terms and conditions, and technical implementation. It is currently expected to involve a recovery tool using zero-knowledge proofs, initiated by users through a portal, designed to help users remain in control of the process while protecting their information. Again, if you are not technically proficient, we recommend waiting for these options to go live. For now, you may submit a ticket at support.secondfi.io. We will continue sharing updates as progress is made.

Important Security Reminder SecondFi / Yoroi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io ▪️ Asset recovery wallet checker: checker.secondfi.io

SecondFi / Yoroi Wallet Guidance Sessions in Tokyo and Osaka We are hosting dedicated in-person guidance sessions during for SecondFi and Yoroi Wallet users affected by the security incident. Each session will include: - A SecondFi / Yoroi update from our CEO - A live Q&A with our specialists - Migration guidance slides Our team will answer your questions and walk you through best practices for securing your wallet, or safely migrating it using the secure wallet export functionality, which will be released soon. Please note the guidance slides are informative only. We will not conduct 1:1 or hands-on wallet troubleshooting. EVENT DETAILS: 📍 Tokyo: Melody Line Hall, 1F, WebX Venue (The Prince Park Tower Tokyo, Minato City) 📅 Tuesday, 14 July 2026, 12:00 to 18:45 JST Register here: luma.com/yhgxd9xj 📍 Osaka: TKP Garden City Umeda Osaka 📅 Saturday, 18 July 2026, 12:00 to 17:45 JST Register here: luma.com/6yse3fmg Sessions are held in English and Japanese. Registration via Luma is required for both, and support is first-come, first-served.

@kuyoro64 @emurgo_io Please see our latest update.

@emurgo_io @secondfiapp What about does that don't have access to their wallet address, how can we go about it?

Today, we formally notified the entities that we will be stepping down from our duties as a member of the Pentad. We want to thank the members for their shared commitment to Cardano throughout our time working alongside them. Our immediate priority is the @secondfiapp recovery process, and we are concentrating our resources where they are needed most. We believe this is the right decision for our users and for the ecosystem, and it reflects the standard of accountability we hold ourselves to as a founding entity of Cardano. As stated by SecondFi, quarantine mode is being enabled this week, letting users check if a wallet address appears in preliminary incident data and submit a support ticket. Our intention is that next week, the secure wallet export will be deployed to help affected users safely move assets to a new wallet. On asset recovery, we continue to make progress with the recovery tool, initiated through a portal, that keeps users in control while protecting their information

Important Security Reminder SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io ▪️ Asset recovery wallet checker: checker.secondfi.io

Your Options for Securing Assets, and What’s Next We recognize that some users may not have completed all steps in the Hardware Wallet Guidance posted in our knowledge base. If you are not technically proficient, we recommend waiting for the secure wallet export functionality, which is currently intended to launch next week. Here is an update on upcoming options: • This week: Quarantine mode We will enable quarantine mode, which will let users check whether a wallet address appears in preliminary incident-related data and submit a support ticket with the relevant wallet address. • Next week: Secure wallet export functionality We intend to deploy secure wallet export as the next phase of quarantine mode. This is intended to provide a safer way for users of varying experience levels to move assets to a new wallet. • On potential asset recovery As stated previously, we intend to support a process relating to potential asset recovery for users whose wallets are confirmed through the applicable process. Any such process remains subject to further investigation, verification, eligibility criteria, applicable terms and conditions, and technical implementation. It is currently expected to involve a recovery tool using zero-knowledge proofs, initiated by users through a portal, designed to help users remain in control of the process while protecting their information. Again, if you are not technically proficient, we recommend waiting for these options to go live. For now, you may submit a ticket at support.secondfi.io. We will continue sharing updates as progress is made.

SecondFi will not resume normal operations, even once the audits are complete. Going forward, our involvement in @secondfiapp is limited to a dedicated asset recovery team, tasked solely with returning assets to affected users. This is where our full focus and resources are directed.

@IanrossWins @JaromirTesar Kindly go to support.secondfi.io to submit a ticket so our team can assist you directly.

@JaromirTesar I just want my money. From Emurgo. Give it back please, @secondfiapp.

Imagine going to a bank to ask for money, and the bank gives it to you without any questions or conditions. No one would call that responsible. Why should Cardano’s treasury operate differently? Due diligence is part of responsible decision-making.

- End of post -

Recovery Fund Address Our commitment remains unequivocal: to support the return of assets to all affected wallet holders from the 4 distinct wallet draining events which we intend to return in their in their original form. Three of these events were executed by external threat actors resulting in a loss of ~16M ADA. To return these assets to the victims of the attack, EMURGO has set up a recovery fund address. You can find it here: addr1qyvvn9e9ulvzw2nvgkwraxwrla4a28l7gmduk7jru2rw9kdxkls8aczwgg8u44nj87uaq50rgcjulcxtzv9q8j0g2lss9kv2ss Assets secured through our emergency rescue response, including those from the fourth event, are currently protected and accessible. These will form part of the recovery effort to return assets to affected users. Important Security Reminder SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io ▪️ Asset recovery wallet checker: checker.secondfi.io

- End of post -

The Asset Recovery Wallet Checker is now live. You can now verify whether your wallet was affected by the incident. The official checker is live at checker.secondfi.io. This is the only official checker. It is hosted on our secondfi.io domain and shared only through @secondfiapp and @secondfi_jp. - It will NEVER ask you to sign a transaction. - Any tool that asks you to sign is not ours and should be treated as fraudulent. This is phase one. In phase two, the checker will show whether your wallet has been affected, alongside an air-gapped transfer option to move assets securely. Important Security Reminder SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io ▪️ Asset recovery wallet checker: checker.secondfi.io

- End of post -

⚠️ Security Alert: Fake Support Emails and Websites We are seeing fraudulent support emails and fake websites impersonating SecondFi to target affected users. Do not respond, do not click any links, and do not enter your details. SecondFi does not provide support through Gmail or any personal email account, and our only official domain is secondfi.io. Always check the address carefully and do not trust links shared with you. SecondFi will never email, DM, or message you first, and we will never ask for your private keys, recovery phrases, or wallet credentials. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io ▪️ Asset recovery wallet checker: checker.secondfi.io

@Peejay_79er Please go to support.secondfi.io to submit a ticket so our team can assist you directly.

Hardware Wallet Migration Guide We have published a step-by-step guide to help users securely move their assets to a new hardware wallet, the most secure option for self-custody. Before you start, keep these in mind: - If you already use a hardware wallet, no action is required. Hardware wallet users were not affected by this incident. - Do not delete the SecondFi app, and keep your seed phrase safe. Either one will be required to claim your assets through the recovery process. - Stop using your existing wallet. Do not send, receive, sign, or stake from it. The full step-by-step guide, including how to test with a small amount before moving your balance, is available here: kb.secondfi.io/en/article/har… Important Security Reminder SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. We will never DM you first. Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent. Our official channels are @secondfiapp, @secondfi_jp, and support.secondfi.io. For support, please submit a ticket only through our official support channel at: support.secondfi.io

@BH609144022841 Please go to support.secondfi.io to submit a ticket so our team can assist you directly.

@secondfiapp This still doesn't cover me. Don't know my address and hardware wallet complicates things for the average user. I am still in limbo waiting for a solution.

🛡 Recovery Process Update Your assets remain safe. Our team's full focus is on recovery. Here is where things stand today: How do I check if my wallet is affected? The asset recovery wallet checker is now live: checker.secondfi.io This is the only official checker, hosted on our secondfi.io domain and shared only through @secondfiapp / @secondfi_jp. It is prepared on a best-efforts basis. It will never ask you to sign a transaction. Any tool that does is a scam. This is phase one. In phase two, the checker will show whether your wallet has been affected, alongside an air-gapped transfer option to move assets securely. I am not affected, what are my options? If you wish to migrate, we recommend moving your assets to a newly created wallet using a hardware wallet only. We will release clear, step-by-step migration instructions to guide you through this. I am affected, what do I do? We are working on an onchain recovery tool. For now, submit a ticket at support.secondfi.io and keep your app and seed phrase safe. Recovery instructions will only be released once the Intersect Security Council has completed its review. How do I recover my assets? Our teams are working with the smartest minds in Cardano, who have dropped everything to work on this incident, to develop an onchain claims portal. Which is now in preview mode and will be released soon. Understanding what happened Several auditors and independent experts are analysing onchain activity and validating our findings. Reports are coming, and we intend to share relevant reports once finalised. We cannot share findings before then, as doing so may cause further issues. How do I make a claim? If you want to make a claim, submit your ticket at support.secondfi.io. Please remember: DO - Keep the SecondFi app installed - Keep your seed phrase safe - Use only checker.secondfi.io to check your wallet - Submit a ticket at support.secondfi.io DON'T - Delete the SecondFi app - Share private keys, recovery phrases, or wallet credentials with anyone - Trust any checker, link, or account outside our official channels - Act on messages telling you to move assets or submit wallet information SecondFi will NEVER request private keys, recovery phrases, or wallet credentials. No recovery actions requiring user participation have begun. @secondfiapp / @secondfi_jp remains the official channel for all updates.

@coher45 @emurgo_io Please go to support.secondfi.io to submit a ticket so our team can assist you directly.

@emurgo_io How do we get our wallet address if I can't open my wallet?

@diegobbmota The asset recovery wallet checker is now live: checker.secondfi.io It will never ask you to sign a transaction. If any tool does, it is not ours and should be treated as fraudulent.

@secondfiapp How can I check if my wallet was affected? My tokens are still there, but I'd like to make sure it wasn't affected.

@Jayc26 The asset recovery wallet checker is now live: checker.secondfi.io It will never ask you to sign a transaction. If any tool does, it is not ours and should be treated as fraudulent.

@secondfiapp How do we know if we have been affected? I know I can't access my wallets or wallet addresses on Secondfi. I imported my wallets from Secondfi to Eternl and Lace previously, so I see my funds, but I can't access them