The Asset Recovery Tool Is Now Live The official asset recovery tool is now available for users whose wallets were affected by the June 2026 security incident. It allows you to verify control of an affected wallet, review any assets eligible for recovery, and submit a recovery request to a new Cardano wallet that you control. The recovery tool is available only at secondfi.io in a web browser. It is not completed through the SecondFi app. You do not need to have submitted a claims ticket before you start. Submitting a recovery request through the official tool begins the claims process for the affected wallet. Recovery is separate from wallet migration. Migration moves supported assets that remain in a wallet to a new wallet. Recovery concerns eligible assets affected by the security incident. How long recovery takes There are two separate stages, each with its own timeframe: -Proof generation, while you use the tool: up to approximately 15 minutes. This takes place on your own device, in your browser, and the browser window must stay open until it is complete. -Claim processing, after you submit: up to five working days. To maintain security measures, submitted claims are processed in batches. No action is needed from you during this stage. Before you start Have the following ready: The recovery phrase for the affected wallet. The tool supports 12, 15, and 24-word recovery phrases. A newly created Cardano wallet that you control, and its receiving address. A hardware wallet can provide an additional layer of security because it keeps private keys offline. A private, trusted computer with a current web browser. Do not use a public or shared computer. A device and internet connection that meet our recommended specifications: at least 2 GB of available memory, a processor no more than five years old, and an internet connection of at least 50 Mbps. Recovery runs entirely in your browser, is demanding on both processing power and memory, and requires you to download a file of about 2 GB. Do not use the affected wallet, an exchange deposit address, or any address you do not control as your destination. How recovery works Recovery is one continuous process. Begin by reading and accepting the Recovery Terms. The tool then takes you through four steps, set out below. If you have more than one affected wallet, repeat the process for each wallet. Step 1: Verify your affected wallet Enter the recovery phrase for one affected wallet. Before you type it, confirm that you are on your own private, trusted computer, that nobody can see your screen, that no screen sharing or recording is running, and that the address bar shows secondfi.io. Step 2: Review what is eligible The tool checks the wallet's addresses against the incident records and shows an estimated breakdown of any assets eligible for recovery. Each affected address is treated as its own request, and only addresses with recoverable assets are submitted. Step 3: Enter your destination address Provide the receiving address of your new Cardano wallet and complete the required confirmations. The destination address is bound into the proof and cannot be changed after you submit. Check every character carefully before you continue. Step 4: Generate the proof and submit The tool generates a zero-knowledge proof on your device for each eligible affected address, binding it to your destination address, and then submits your recovery request. Proof generation can take up to approximately 15 minutes. How long it takes depends on your device's processing power and your internet connection, which is why we recommend the device specifications listed above. It may take longer on older or less powerful computers and for wallets with more affected addresses. Keep the browser window open and do not leave or refresh the page until proof generation is complete. If it is interrupted, the tool will show a retry option. After you submit Once your request has been validated and submitted, it enters claim processing. Claims are processed in batches, so allow up to five working days for your request to be processed and for recovered assets to arrive in your destination wallet. No further action is required unless the tool or our official channels tell you otherwise. Please remember: This is not instant, it will take up to five working days for your request to be processed. You can check your status at any time using the status checker at secondfi.io by entering your new destination address, not the affected wallet address. Why the tool asks for your recovery phrase Your recovery phrase is used locally in your browser to generate the zero-knowledge proof. It is not stored or transmitted. Only the proof is submitted with your recovery request. Browser and security tool warnings Because the recovery tool uses your existing recovery phrase to prove ownership of your wallet, some anti-phishing tools, anti-scam tools and browser extensions may show a warning, or display a blank screen, when you open the tool or enter your recovery phrase. This alone does not mean the official tool is malicious. Before you continue, always check that you are on the exact official domain, secondfi.io, with HTTPS and no extra words, characters or lookalike spellings. Always type the address yourself rather than following a link sent by direct message, email, advertisement or any other third party. What can be recovered Amounts are assessed against the incident snapshot and shown as an estimate. The final amount may differ. For each eligible NFT that cannot be returned directly, a fixed amount of 30 ADA will be included in the ADA shown for the relevant affected address. Rules that protect you Type secondfi.io directly into your browser or from the official X account mentioned below. Never follow a link from an email, advertisement, direct message, or search result. Enter your recovery phrase only yourself, and only in the official recovery flow after confirming that the address bar shows exactly secondfi.io. Make sure nobody can see your screen and that no screen sharing or recording is running. Do not install any browser extension or application claiming to be required for recovery. No fee is required. Anyone who asks you to pay a fee, send ADA or another asset, sign a transaction, or transfer assets to an address they provide is attempting to defraud you. We will never contact you first to ask you to begin recovery. Do not use the affected wallet again. Recovery does not make it safe to use. Our official channels X accounts: @secondfiapp and @secondfi_jp Support portal: support.secondfi.io

Update on ADA Staking Rewards for Affected Wallets We’ve received several questions about staking rewards following the recent security incident. Here is what you need to know: Is my affected wallet still earning rewards? No. The ADA in affected wallets is no longer staked, meaning these addresses are not actively earning new rewards. Will lost rewards be compensated? - Already-allocated rewards: If rewards were allocated and transferred to an affected wallet during the incident period, they will be included in the recovery process. - Unallocated rewards: Rewards that were not yet allocated or paid out at the time of the incident are not currently included in the claim process. 📖 Read the full breakdown in our Incident FAQ: kb.secondfi.io/en/article/in… ⚠️ Stay safe: Always verify links through our official channels only: @secondfiapp, @secondfi_jp, and support.secondfi.io.

🛡 The Wallet Migration Tool is Now Live. The wallet migration tool is available in the SecondFi app. This tool is for users who still hold Cardano assets in SecondFi. It moves what you currently hold out to your newly created Cardano wallet destination address. We encourage everyone with a remaining Cardano balance to migrate, whether or not you were affected by the incident, because SecondFi is winding down. If your wallet was emptied in the incident, the tool you are waiting for is the asset recovery tool, and we expect it to be available in September. Migrating does not affect your claim. About the migration tool: - It moves your entire Cardano balance (including all ADA, native tokens, and NFTs) from your current wallet to the destination address of a newly created Cardano wallet from a provider of your choice. The tool has been audited by @Bitdefender. Before you start: - Create a new Cardano wallet with a provider of your choice and have the destination address ready. We recommend using a hardware wallet. How it works: - The tool handles the technical steps automatically. - If your ADA is currently staked, the tool will unstake it so the full amount can be included in the transfer. - This also means your DRep delegation will no longer be active, so you will need to delegate to a DRep again from your new wallet to continue participating in Cardano governance. - You will need to migrate one wallet at a time. Important reminders: - Blockchain transfers cannot be reversed once signed and submitted. - Check your destination address carefully. Only send to a Cardano wallet you control, never to an exchange deposit address. - The migration tool moves Cardano assets only. Non-Cardano assets will need to be moved separately. - Please do not delete your original wallet from SecondFi or the application itself, as it may be needed for the asset recovery process. The video below walks through the full process. Read the full FAQ: kb.secondfi.io/en/article/se…

A reminder ahead of both launches. We anticipate an increase in fraud attempts targeting users. Criminals monitor incidents and prepare in advance. Fraudulent sites and social media campaigns can be deployed quickly following the announcement of a migration or recovery process, particularly when users may feel pressure to act. Treat any unsolicited approach concerning migration, recovery, or your SecondFi wallet as potentially fraudulent. Our official channels are @secondfiapp and @secondfi_jp on X, and support.secondfi.io.

Wallet Migration Tool Launch Update The wallet migration tool is awaiting review from the Apple App Store and Google Play. This is the final outstanding step before launch. The tool is not yet available and is now expected to launch next week, subject to completion of the app-store review process. The revised timing will also allow us to provide in-person guidance sessions as users begin migrating. In the meantime, users can prepare by creating a new Cardano wallet with a provider of their choice and having the destination address ready. We recommend using a hardware wallet where possible. We will confirm through our official channels as soon as the tool is available. Until then, do not use any link or application claiming to provide access to the migration tool. Important Security Reminder: - Use only links published through our official channels: @secondfiapp, @secondfi_jp, and support.secondfi.io. - Do not rely on links from any other source unless their authenticity has been confirmed through our official website. Launch dates may change if additional security or operational work is required. - There are several scam and impersonator accounts. We will continue to remind you of the security risks. It is equally important that users are vigilant and take accountability for using the correct links and following the instructions to avoid scams.

An update regarding the recent security incident involving SecondFi What happened to SecondFi Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide users with a transparent update based on the information currently available. An independent investigation EMURGO engaged Groom Lake, an independent forensic investigation / blockchain intelligence provider to assist with tracing and evidentiary analysis and they reviewed the incident using primary technical evidence, including code, code history, and public blockchain data. What the investigation indicates to date: 1. Attack from an external actor: linked to high-volume addresses employing advanced tradecraft: @0xGroomLake indicates that the primary operation behind the unauthorised transfers was sophisticated, external, and well-funded, with indicators consistent with activity by a professional, state-aligned threat actor. Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group. 2. Two separate attackers: Groom Lake also identified activity by a second party that appears, based on current evidence, to be separate from the primary operation and to have affected a different set of wallets during the same window. No overlap in affected wallets has been identified to date. The root cause: A cryptographic flaw The root cause was a highly subtle flaw in how the wallet software generated per-transaction signatures. In simplified terms, a value that should have been derived from secret information could, under certain conditions, be computed from public transaction data. This could enable affected private key material to be derived from information visible on the public blockchain. This cryptographic flaw was also visible in a copy of the relevant code that had been published without authorisation to a public GitHub repository. We are continuing to assess the circumstances surrounding the publication and are cooperating with the relevant authorities. Fix and winding down of SecondFi The flaw has been patched, and new wallets created with the corrected software are not known to be affected by this issue. However, given the gravity of this event and as previously announced, we have made the difficult decision to wind down SecondFi and Yoroi wallet. Asset recovery and safe migration Our current priority is supporting affected users, assisting recovery efforts, and enabling users to move assets securely. 1. Recovery tool: A secure recovery tool using zero-knowledge (ZK) proofs is being developed. The portal is designed to allow users to initiate the process directly while limiting the information required to do so. The tool is currently in testing, and we are engaging a specialist third-party auditor to review it before its anticipated release in August 2026. 2. Safe migration: In the meantime, we are preparing wallet export functionality designed to allow users to migrate their assets to a wallet of their choice. We anticipate releasing this by early August 2026. Please follow our official channels for further updates. Important Security Reminder SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal: support.secondfi.io