"I want to express my gratitude to the SecondFi and EMURGO teams. They truly kept their word and demonstrated real responsibility. While not everything was fully recovered, I am well satisfied with the resolution. I also apologize for my earlier harsh words born out of anxiety.
The Asset Recovery Tool Is Now Live
The official asset recovery tool is now available for users whose wallets were affected by the June 2026 security incident. It allows you to verify control of an affected wallet, review any assets eligible for recovery, and submit a recovery request to a new Cardano wallet that you control.
The recovery tool is available only at secondfi.io in a web browser. It is not completed through the SecondFi app. You do not need to have submitted a claims ticket before you start. Submitting a recovery request through the official tool begins the claims process for the affected wallet.
Recovery is separate from wallet migration. Migration moves supported assets that remain in a wallet to a new wallet. Recovery concerns eligible assets affected by the security incident.
How long recovery takes
There are two separate stages, each with its own timeframe:
-Proof generation, while you use the tool: up to approximately 15 minutes. This takes place on your own device, in your browser, and the browser window must stay open until it is complete.
-Claim processing, after you submit: up to five working days. To maintain security measures, submitted claims are processed in batches. No action is needed from you during this stage.
Before you start
Have the following ready:
The recovery phrase for the affected wallet. The tool supports 12, 15, and 24-word recovery phrases.
A newly created Cardano wallet that you control, and its receiving address. A hardware wallet can provide an additional layer of security because it keeps private keys offline.
A private, trusted computer with a current web browser. Do not use a public or shared computer.
A device and internet connection that meet our recommended specifications: at least 2 GB of available memory, a processor no more than five years old, and an internet connection of at least 50 Mbps. Recovery runs entirely in your browser, is demanding on both processing power and memory, and requires you to download a file of about 2 GB.
Do not use the affected wallet, an exchange deposit address, or any address you do not control as your destination.
How recovery works
Recovery is one continuous process. Begin by reading and accepting the Recovery Terms. The tool then takes you through four steps, set out below.
If you have more than one affected wallet, repeat the process for each wallet.
Step 1: Verify your affected wallet
Enter the recovery phrase for one affected wallet. Before you type it, confirm that you are on your own private, trusted computer, that nobody can see your screen, that no screen sharing or recording is running, and that the address bar shows secondfi.io.
Step 2: Review what is eligible
The tool checks the wallet's addresses against the incident records and shows an estimated breakdown of any assets eligible for recovery. Each affected address is treated as its own request, and only addresses with recoverable assets are submitted.
Step 3: Enter your destination address
Provide the receiving address of your new Cardano wallet and complete the required confirmations.
The destination address is bound into the proof and cannot be changed after you submit. Check every character carefully before you continue.
Step 4: Generate the proof and submit
The tool generates a zero-knowledge proof on your device for each eligible affected address, binding it to your destination address, and then submits your recovery request.
Proof generation can take up to approximately 15 minutes. How long it takes depends on your device's processing power and your internet connection, which is why we recommend the device specifications listed above. It may take longer on older or less powerful computers and for wallets with more affected addresses.
Keep the browser window open and do not leave or refresh the page until proof generation is complete. If it is interrupted, the tool will show a retry option.
After you submit
Once your request has been validated and submitted, it enters claim processing. Claims are processed in batches, so allow up to five working days for your request to be processed and for recovered assets to arrive in your destination wallet. No further action is required unless the tool or our official channels tell you otherwise.
Please remember: This is not instant, it will take up to five working days for your request to be processed.
You can check your status at any time using the status checker at secondfi.io by entering your new destination address, not the affected wallet address.
Why the tool asks for your recovery phrase
Your recovery phrase is used locally in your browser to generate the zero-knowledge proof. It is not stored or transmitted. Only the proof is submitted with your recovery request.
Browser and security tool warnings
Because the recovery tool uses your existing recovery phrase to prove ownership of your wallet, some anti-phishing tools, anti-scam tools and browser extensions may show a warning, or display a blank screen, when you open the tool or enter your recovery phrase. This alone does not mean the official tool is malicious.
Before you continue, always check that you are on the exact official domain, secondfi.io, with HTTPS and no extra words, characters or lookalike spellings. Always type the address yourself rather than following a link sent by direct message, email, advertisement or any other third party.
What can be recovered
Amounts are assessed against the incident snapshot and shown as an estimate. The final amount may differ.
For each eligible NFT that cannot be returned directly, a fixed amount of 30 ADA will be included in the ADA shown for the relevant affected address.
Rules that protect you
Type secondfi.io directly into your browser or from the official X account mentioned below. Never follow a link from an email, advertisement, direct message, or search result.
Enter your recovery phrase only yourself, and only in the official recovery flow after confirming that the address bar shows exactly secondfi.io. Make sure nobody can see your screen and that no screen sharing or recording is running.
Do not install any browser extension or application claiming to be required for recovery.
No fee is required. Anyone who asks you to pay a fee, send ADA or another asset, sign a transaction, or transfer assets to an address they provide is attempting to defraud you.
We will never contact you first to ask you to begin recovery.
Do not use the affected wallet again. Recovery does not make it safe to use.
Our official channels
X accounts: @secondfiapp and @secondfi_jp
Support portal: support.secondfi.io
รอดูผลลัพธ์ต่อไป หากทุกอย่างกลับมา. ฉันมีอะไรจะบอกพวกเขาและทีมงาน
The Asset Recovery Tool Is Now Live
The official asset recovery tool is now available for users whose wallets were affected by the June 2026 security incident. It allows you to verify control of an affected wallet, review any assets eligible for recovery, and submit a recovery request to a new Cardano wallet that you control.
The recovery tool is available only at secondfi.io in a web browser. It is not completed through the SecondFi app. You do not need to have submitted a claims ticket before you start. Submitting a recovery request through the official tool begins the claims process for the affected wallet.
Recovery is separate from wallet migration. Migration moves supported assets that remain in a wallet to a new wallet. Recovery concerns eligible assets affected by the security incident.
How long recovery takes
There are two separate stages, each with its own timeframe:
-Proof generation, while you use the tool: up to approximately 15 minutes. This takes place on your own device, in your browser, and the browser window must stay open until it is complete.
-Claim processing, after you submit: up to five working days. To maintain security measures, submitted claims are processed in batches. No action is needed from you during this stage.
Before you start
Have the following ready:
The recovery phrase for the affected wallet. The tool supports 12, 15, and 24-word recovery phrases.
A newly created Cardano wallet that you control, and its receiving address. A hardware wallet can provide an additional layer of security because it keeps private keys offline.
A private, trusted computer with a current web browser. Do not use a public or shared computer.
A device and internet connection that meet our recommended specifications: at least 2 GB of available memory, a processor no more than five years old, and an internet connection of at least 50 Mbps. Recovery runs entirely in your browser, is demanding on both processing power and memory, and requires you to download a file of about 2 GB.
Do not use the affected wallet, an exchange deposit address, or any address you do not control as your destination.
How recovery works
Recovery is one continuous process. Begin by reading and accepting the Recovery Terms. The tool then takes you through four steps, set out below.
If you have more than one affected wallet, repeat the process for each wallet.
Step 1: Verify your affected wallet
Enter the recovery phrase for one affected wallet. Before you type it, confirm that you are on your own private, trusted computer, that nobody can see your screen, that no screen sharing or recording is running, and that the address bar shows secondfi.io.
Step 2: Review what is eligible
The tool checks the wallet's addresses against the incident records and shows an estimated breakdown of any assets eligible for recovery. Each affected address is treated as its own request, and only addresses with recoverable assets are submitted.
Step 3: Enter your destination address
Provide the receiving address of your new Cardano wallet and complete the required confirmations.
The destination address is bound into the proof and cannot be changed after you submit. Check every character carefully before you continue.
Step 4: Generate the proof and submit
The tool generates a zero-knowledge proof on your device for each eligible affected address, binding it to your destination address, and then submits your recovery request.
Proof generation can take up to approximately 15 minutes. How long it takes depends on your device's processing power and your internet connection, which is why we recommend the device specifications listed above. It may take longer on older or less powerful computers and for wallets with more affected addresses.
Keep the browser window open and do not leave or refresh the page until proof generation is complete. If it is interrupted, the tool will show a retry option.
After you submit
Once your request has been validated and submitted, it enters claim processing. Claims are processed in batches, so allow up to five working days for your request to be processed and for recovered assets to arrive in your destination wallet. No further action is required unless the tool or our official channels tell you otherwise.
Please remember: This is not instant, it will take up to five working days for your request to be processed.
You can check your status at any time using the status checker at secondfi.io by entering your new destination address, not the affected wallet address.
Why the tool asks for your recovery phrase
Your recovery phrase is used locally in your browser to generate the zero-knowledge proof. It is not stored or transmitted. Only the proof is submitted with your recovery request.
Browser and security tool warnings
Because the recovery tool uses your existing recovery phrase to prove ownership of your wallet, some anti-phishing tools, anti-scam tools and browser extensions may show a warning, or display a blank screen, when you open the tool or enter your recovery phrase. This alone does not mean the official tool is malicious.
Before you continue, always check that you are on the exact official domain, secondfi.io, with HTTPS and no extra words, characters or lookalike spellings. Always type the address yourself rather than following a link sent by direct message, email, advertisement or any other third party.
What can be recovered
Amounts are assessed against the incident snapshot and shown as an estimate. The final amount may differ.
For each eligible NFT that cannot be returned directly, a fixed amount of 30 ADA will be included in the ADA shown for the relevant affected address.
Rules that protect you
Type secondfi.io directly into your browser or from the official X account mentioned below. Never follow a link from an email, advertisement, direct message, or search result.
Enter your recovery phrase only yourself, and only in the official recovery flow after confirming that the address bar shows exactly secondfi.io. Make sure nobody can see your screen and that no screen sharing or recording is running.
Do not install any browser extension or application claiming to be required for recovery.
No fee is required. Anyone who asks you to pay a fee, send ADA or another asset, sign a transaction, or transfer assets to an address they provide is attempting to defraud you.
We will never contact you first to ask you to begin recovery.
Do not use the affected wallet again. Recovery does not make it safe to use.
Our official channels
X accounts: @secondfiapp and @secondfi_jp
Support portal: support.secondfi.io
You took everything from us, but you say there's no guarantee we'll get everything back, even though you previously promised a full refund.
Your fund was established to help those in need, wasn't it? We don't want your money back; we want our money back.
SecondFi Incident Recovery: Asset Recovery Tool Update
Final security review and zero-knowledge ceremony complete. We expect to deploy the asset recovery tool next week.
In our last progress report, we outlined the remaining steps before the asset recovery tool could launch. Those steps are now complete, and we are preparing to deploy the tool next week.
Final security review concluded
The asset recovery tool's zero-knowledge proof audit, carried out by @zksecurityXYZ, was finalised on 9 September, and its smart contract audit on 11 September. The final external security review of the recovery system, which began on 14 September, has now concluded and all findings have been resolved. Audits and reviews reduce risk but do not guarantee the absence of vulnerabilities.
Zero-knowledge ceremony completed
Zero-knowledge ceremony completed. To generate the cryptographic parameters required to verify recovery proofs securely, we successfully completed the multi-party zero-knowledge ceremony. Independent contributors from multiple organizations generated, verified, and signed the final parameters to ensure the system's integrity before deployment.
What happens next
Subject to final checks, the asset recovery tool will be deployed next week. Full instructions on how to use it, together with the Recovery Terms that will govern its use, will be published through our official channels at launch.
Until then:
-If your wallet was affected by the incident, wait for the official launch announcement. Do not act on any tool or link that claims to recover your assets before then.
-Eligibility and the conditions for recovery will be set out in the Recovery Terms, and use of the tool will be subject to them.
-Recovery is limited to the assets available for recovery, and we cannot guarantee that every affected wallet will recover its full balance.
-If your wallet was not affected and you hold a balance, use the migration tool in the SecondFi app to move your assets to a new wallet.
Beware of impersonation attempts and scammers
Impersonators posing as EMURGO, Yoroi or SecondFi staff are multiplying fast, all trying to get hold of affected users' seed phrases.
Because of this, all SecondFi communication will come only from the official account, not from individual employees. The scale of these scams also means we must be extra vigilant in how we operate, including closing comments on our posts.
Security reminder
We anticipate an increase in fraud attempts around the launch. We will never initiate contact with you, ask you to send funds to any address, or charge a fee for recovery. Any message instructing you to transfer assets or share wallet information outside our official channels should be treated as fraudulent.
The asset recovery tool operates outside the official SecondFi app and will require you to enter your recovery phrase as part of the automated recovery process. The tool is designed so that your recovery phrase is processed only on your device and is not transmitted or stored.
The tool will only ever be available at SecondFi.io, which will be announced only through our official channels. Use the tool only on a device you trust and that is free of malware. Never provide it to a person, support representative, direct-message account, third-party website, or third-party application other than the asset recovery tool at that official address.
If you need support, submit a ticket at support.secondfi.io. @secondfiapp and @secondfi_jp remain the official channels for all updates.
ระบบที่ซื้อมาไม่ตอบโจทย์ แล้วจะทำยังไง? youtube.com/shorts/xdP81fd30… ผ่าน @YouTube
กลับมาดูแลร้าน แล้วเจอเงินหายหลายพันทุกเดือน youtube.com/shorts/KLJKJFlC1… ผ่าน @YouTube
อายุ 39 ผมลาออกจากงานแบบไม่มีแผน youtube.com/shorts/tzmPLUZWU… ผ่าน @YouTube
ขอเชิญพี่ๆ เพื่อนๆ คนที่มีรายได้วันละ 1000-3000 บาท/วัน แชร์ไอเดียหน่อยว่าพี่ๆ เพื่อนๆ ทำอาชีพอะไรกัน เพื่อเป็นไอเดียให้กับคนที่ลาออกจากงาน หรือกำลังจะออกจากงาน
youtube.com/@1tapakorn/commu… #ลาออก #BeckyxMFWTodsSS27 #PatrickCohen #โหนกระแส
What time comback?
Update on ADA Staking Rewards for Affected Wallets
We’ve received several questions about staking rewards following the recent security incident. Here is what you need to know:
Is my affected wallet still earning rewards?
No. The ADA in affected wallets is no longer staked, meaning these addresses are not actively earning new rewards.
Will lost rewards be compensated?
- Already-allocated rewards: If rewards were allocated and transferred to an affected wallet during the incident period, they will be included in the recovery process.
- Unallocated rewards: Rewards that were not yet allocated or paid out at the time of the incident are not currently included in the claim process.
📖 Read the full breakdown in our Incident FAQ: kb.secondfi.io/en/article/in…
⚠️ Stay safe:
Always verify links through our official channels only: @secondfiapp, @secondfi_jp, and support.secondfi.io.
ฐปกร คล้ายฉ่ำ retweeted
Update on ADA Staking Rewards for Affected Wallets
We’ve received several questions about staking rewards following the recent security incident. Here is what you need to know:
Is my affected wallet still earning rewards?
No. The ADA in affected wallets is no longer staked, meaning these addresses are not actively earning new rewards.
Will lost rewards be compensated?
- Already-allocated rewards: If rewards were allocated and transferred to an affected wallet during the incident period, they will be included in the recovery process.
- Unallocated rewards: Rewards that were not yet allocated or paid out at the time of the incident are not currently included in the claim process.
📖 Read the full breakdown in our Incident FAQ: kb.secondfi.io/en/article/in…
⚠️ Stay safe:
Always verify links through our official channels only: @secondfiapp, @secondfi_jp, and support.secondfi.io.
They've postponed it again. That's really disappointing, because we've been waiting for so long.
Security Audit Update: Asset Recovery Tool
As we prepare to launch the Asset Recovery Tool for users affected by the security incident, we are providing an update on our technical progress and security review.
On 3 August 2026, we engaged @zksecurityXYZ to conduct an independent security audit of our proof-tool repository. Developed for SecondFi, the tool allows users to verify control of a Cardano wallet credential through zero-knowledge proofs, without disclosing private keys or derivation paths.
The system is designed to optimize computing and memory requirements so that users can generate proofs directly in their browsers. The project includes custom circuits and prover patches to the consensys/gnark and consensys/gnark-crypto repositories.
Audit Results
- High-severity issues: zkSecurity identified two high-severity issues in the upstream code. We implemented fixes for both issues, and zkSecurity reviewed, tested, and confirmed that the issues were resolved.
- Low-severity issues: Two low-severity issues in the target repository remain open. zkSecurity assessed both issues as not practically exploitable.
The complete audit report, including the detailed technical findings, is available here: reports.zksecurity.xyz/repor…
About the Asset Recovery Tool
- User-initiated: Affected users control when to begin their Recovery Request.
- Cardano-first: The tool uses zero-knowledge proof technology to verify wallet control and facilitate the safe recovery of assets without requiring users to provide seed phrases or private keys.
Next Steps and Launch Timeline
- Smart contract audit: The next testing phase will include a dedicated audit of the recovery smart contract. We will provide a further update when that review is complete.
- Production launch: Subject to completion of the remaining audit and final production checks, the Asset Recovery Tool is expected to launch in the coming weeks.
- User guidance: We will publish step-by-step instructions and user guides before launch.
- Security reminder: Please rely only on information published through SecondFi’s official channels. SecondFi will never ask you to provide your seed phrase or private keys.
Our official channels are @secondfiapp and @secondfi_jp on X, and support.secondfi.io
Ten days have passed, but there's still no progress. Will they actually return the assets to those affected?
🛡 Recovery Process Update: Wallet Transfer Guidance Coming Soon
Ahead of the wallet migration tool going live, we will be sharing detailed step-by-step instructions and a video walkthrough of the full wallet transfer process.
Please wait for this official guidance before taking any action.
When it is ready, we will share it through our official channels.
If anyone shares migration instructions, links, or tools before then, or claims to be helping you migrate, treat it as a scam. There is no action to take yet.
Three days passed, and they remained silent.
⚠️ Recovery Update: Bounty Offer Made to Attacker
To keep our community informed on our recovery efforts, we want to provide more context regarding the second attack that occurred during the recent security incident.
Context on the 2nd Attack: Shortly after the initial breach, a second, entirely unrelated party exploited the same vulnerability. This independent actor capitalized on the exploit to drain an additional ~4 million ADA (along with various Cardano Native Tokens) from compromised user wallets.
Our Outreach & Bounty Offer: Approximately two weeks ago, we contacted this secondary attacker directly via an onchain message sent to the wallet holding the stolen funds. We offered a standard white-hat resolution:
🔹 Return 90% of the funds (3,618,421 ADA + CNTs) to our recovery address
🔹 Retain 10% (402,047 ADA) as a bounty
🔹 Deadline: 10 July 2026, 23:59 UTC
The onchain message can be verified here: cexplorer.io/tx/3029f7de173a…
The deadline has passed and we have yet to receive a response.
As stated in our message, this offer does not waive any rights, remedies, claims, or options, including the ability to continue the investigation, coordinate with third parties, or pursue legal and law enforcement channels where appropriate.
We will share further updates through our official channels.
