The Asset Recovery Tool Is Now Live The official asset recovery tool is now available for users whose wallets were affected by the June 2026 security incident. It allows you to verify control of an affected wallet, review any assets eligible for recovery, and submit a recovery request to a new Cardano wallet that you control. The recovery tool is available only at secondfi.io in a web browser. It is not completed through the SecondFi app. You do not need to have submitted a claims ticket before you start. Submitting a recovery request through the official tool begins the claims process for the affected wallet. Recovery is separate from wallet migration. Migration moves supported assets that remain in a wallet to a new wallet. Recovery concerns eligible assets affected by the security incident. How long recovery takes There are two separate stages, each with its own timeframe: -Proof generation, while you use the tool: up to approximately 15 minutes. This takes place on your own device, in your browser, and the browser window must stay open until it is complete. -Claim processing, after you submit: up to five working days. To maintain security measures, submitted claims are processed in batches. No action is needed from you during this stage. Before you start Have the following ready: The recovery phrase for the affected wallet. The tool supports 12, 15, and 24-word recovery phrases. A newly created Cardano wallet that you control, and its receiving address. A hardware wallet can provide an additional layer of security because it keeps private keys offline. A private, trusted computer with a current web browser. Do not use a public or shared computer. A device and internet connection that meet our recommended specifications: at least 2 GB of available memory, a processor no more than five years old, and an internet connection of at least 50 Mbps. Recovery runs entirely in your browser, is demanding on both processing power and memory, and requires you to download a file of about 2 GB. Do not use the affected wallet, an exchange deposit address, or any address you do not control as your destination. How recovery works Recovery is one continuous process. Begin by reading and accepting the Recovery Terms. The tool then takes you through four steps, set out below. If you have more than one affected wallet, repeat the process for each wallet. Step 1: Verify your affected wallet Enter the recovery phrase for one affected wallet. Before you type it, confirm that you are on your own private, trusted computer, that nobody can see your screen, that no screen sharing or recording is running, and that the address bar shows secondfi.io. Step 2: Review what is eligible The tool checks the wallet's addresses against the incident records and shows an estimated breakdown of any assets eligible for recovery. Each affected address is treated as its own request, and only addresses with recoverable assets are submitted. Step 3: Enter your destination address Provide the receiving address of your new Cardano wallet and complete the required confirmations. The destination address is bound into the proof and cannot be changed after you submit. Check every character carefully before you continue. Step 4: Generate the proof and submit The tool generates a zero-knowledge proof on your device for each eligible affected address, binding it to your destination address, and then submits your recovery request. Proof generation can take up to approximately 15 minutes. How long it takes depends on your device's processing power and your internet connection, which is why we recommend the device specifications listed above. It may take longer on older or less powerful computers and for wallets with more affected addresses. Keep the browser window open and do not leave or refresh the page until proof generation is complete. If it is interrupted, the tool will show a retry option. After you submit Once your request has been validated and submitted, it enters claim processing. Claims are processed in batches, so allow up to five working days for your request to be processed and for recovered assets to arrive in your destination wallet. No further action is required unless the tool or our official channels tell you otherwise. Please remember: This is not instant, it will take up to five working days for your request to be processed. You can check your status at any time using the status checker at secondfi.io by entering your new destination address, not the affected wallet address. Why the tool asks for your recovery phrase Your recovery phrase is used locally in your browser to generate the zero-knowledge proof. It is not stored or transmitted. Only the proof is submitted with your recovery request. Browser and security tool warnings Because the recovery tool uses your existing recovery phrase to prove ownership of your wallet, some anti-phishing tools, anti-scam tools and browser extensions may show a warning, or display a blank screen, when you open the tool or enter your recovery phrase. This alone does not mean the official tool is malicious. Before you continue, always check that you are on the exact official domain, secondfi.io, with HTTPS and no extra words, characters or lookalike spellings. Always type the address yourself rather than following a link sent by direct message, email, advertisement or any other third party. What can be recovered Amounts are assessed against the incident snapshot and shown as an estimate. The final amount may differ. For each eligible NFT that cannot be returned directly, a fixed amount of 30 ADA will be included in the ADA shown for the relevant affected address. Rules that protect you Type secondfi.io directly into your browser or from the official X account mentioned below. Never follow a link from an email, advertisement, direct message, or search result. Enter your recovery phrase only yourself, and only in the official recovery flow after confirming that the address bar shows exactly secondfi.io. Make sure nobody can see your screen and that no screen sharing or recording is running. Do not install any browser extension or application claiming to be required for recovery. No fee is required. Anyone who asks you to pay a fee, send ADA or another asset, sign a transaction, or transfer assets to an address they provide is attempting to defraud you. We will never contact you first to ask you to begin recovery. Do not use the affected wallet again. Recovery does not make it safe to use. Our official channels X accounts: @secondfiapp and @secondfi_jp Support portal: support.secondfi.io

Security reminder The SecondFi Asset Recovery Tool is live for wallets affected by the June 2026 security incident. Recovery has worked successfully for those users who have followed our instructions. The recovery tool uses your existing recovery phrase to prove ownership of your wallet. Your recovery phrase is used locally in your browser to generate the zero-knowledge proof. It is not stored or transmitted. Only the proof is submitted with your recovery request. Impersonators and scammers will continue to target affected users. Only access the tool through the official SecondFi website, secondfi.io, either by typing it directly into your browser or by clicking through from within the SecondFi app. Do not use links from emails, ads, DMs or search results. Only enter your recovery phrase yourself, within the official recovery flow at secondfi.io. SecondFi support, staff, partners and community members will never ask for it. There are no recovery fees, and SecondFi will never contact you first to start a recovery. Official channels: @secondfiapp and @secondfi_jp

Security reminder Impersonators and scammers continue to target users affected by the June 2026 security incident. The official Asset Recovery Tool is only available at secondfi.io. Type it directly into your browser or click through from within the SecondFi app. Do not use links from emails, ads, DMs or search results. Only enter your recovery phrase yourself, within the official recovery flow at secondfi.io. SecondFi support, staff, partners and community members will never ask for it. There are no recovery fees, and SecondFi will never contact you first to start a recovery. Official channels: @secondfiapp and @secondfi_jp Support: support.secondfi.io

Security reminder The SecondFi Asset Recovery Tool is now live for wallets affected by the June 2026 security incident. Recovery has worked successfully for those users who have followed our instructions. Impersonators and scammers will continue to target affected users. We have seen instances where seed-phrases may have been shared and are now compromised. Please follow our advice. Only access the tool through the official SecondFi website, secondfi.io, either by typing it directly into your browser or by clicking through from within the SecondFi app. Do not use links from emails, ads, DMs or search results. Only enter your recovery phrase yourself, within the official recovery flow at secondfi.io. SecondFi support, staff, partners and community members will never ask for it. There are no recovery fees, and SecondFi will never contact you first to start a recovery. Official channels: @secondfiapp and @secondfi_jp Support: support.secondfi.io

Since the Asset Recovery Tool went live, we have received a strong number of recovery requests. As of yesterday, the first batch of requests has been successfully processed for affected users.

🤝

The Asset Recovery Tool is in motion and requests are coming through. Please keep in mind the process is not instant and allow up to five working days for your request to be processed and for recovered assets to arrive in your destination wallet. You can check your status at any time using the status checker at secondfi.io by entering your new destination address, not the affected wallet address.

An update on the SecondFi card programme The SecondFi card programme will close on 30 November 2026. - In agreement with Wirex, SecondFi has decided to cancel all cards following that date. - Cardholders are encouraged to spend any remaining balance before 30 November 2026. - Certain transactions are not supported, including purchases at online stores requiring 3DS authentication. - For any queries, our support team is available at kb.secondfi.io/en Use only links published through our official channels: @secondfiapp, @secondfi_jp, and support.secondfi.io.

SecondFi Incident Recovery: Asset Recovery Tool Update Final security review and zero-knowledge ceremony complete. We expect to deploy the asset recovery tool next week. In our last progress report, we outlined the remaining steps before the asset recovery tool could launch. Those steps are now complete, and we are preparing to deploy the tool next week. Final security review concluded The asset recovery tool's zero-knowledge proof audit, carried out by @zksecurityXYZ, was finalised on 9 September, and its smart contract audit on 11 September. The final external security review of the recovery system, which began on 14 September, has now concluded and all findings have been resolved. Audits and reviews reduce risk but do not guarantee the absence of vulnerabilities. Zero-knowledge ceremony completed Zero-knowledge ceremony completed. To generate the cryptographic parameters required to verify recovery proofs securely, we successfully completed the multi-party zero-knowledge ceremony. Independent contributors from multiple organizations generated, verified, and signed the final parameters to ensure the system's integrity before deployment. What happens next Subject to final checks, the asset recovery tool will be deployed next week. Full instructions on how to use it, together with the Recovery Terms that will govern its use, will be published through our official channels at launch. Until then: -If your wallet was affected by the incident, wait for the official launch announcement. Do not act on any tool or link that claims to recover your assets before then. -Eligibility and the conditions for recovery will be set out in the Recovery Terms, and use of the tool will be subject to them. -Recovery is limited to the assets available for recovery, and we cannot guarantee that every affected wallet will recover its full balance. -If your wallet was not affected and you hold a balance, use the migration tool in the SecondFi app to move your assets to a new wallet. Beware of impersonation attempts and scammers Impersonators posing as EMURGO, Yoroi or SecondFi staff are multiplying fast, all trying to get hold of affected users' seed phrases. Because of this, all SecondFi communication will come only from the official account, not from individual employees. The scale of these scams also means we must be extra vigilant in how we operate, including closing comments on our posts. Security reminder We anticipate an increase in fraud attempts around the launch. We will never initiate contact with you, ask you to send funds to any address, or charge a fee for recovery. Any message instructing you to transfer assets or share wallet information outside our official channels should be treated as fraudulent. The asset recovery tool operates outside the official SecondFi app and will require you to enter your recovery phrase as part of the automated recovery process. The tool is designed so that your recovery phrase is processed only on your device and is not transmitted or stored. The tool will only ever be available at SecondFi.io, which will be announced only through our official channels. Use the tool only on a device you trust and that is free of malware. Never provide it to a person, support representative, direct-message account, third-party website, or third-party application other than the asset recovery tool at that official address. If you need support, submit a ticket at support.secondfi.io. @secondfiapp and @secondfi_jp remain the official channels for all updates.

Update on ADA Staking Rewards for Affected Wallets We’ve received several questions about staking rewards following the recent security incident. Here is what you need to know: Is my affected wallet still earning rewards? No. The ADA in affected wallets is no longer staked, meaning these addresses are not actively earning new rewards. Will lost rewards be compensated? - Already-allocated rewards: If rewards were allocated and transferred to an affected wallet during the incident period, they will be included in the recovery process. - Unallocated rewards: Rewards that were not yet allocated or paid out at the time of the incident are not currently included in the claim process. 📖 Read the full breakdown in our Incident FAQ: kb.secondfi.io/en/article/in… ⚠️ Stay safe: Always verify links through our official channels only: @secondfiapp, @secondfi_jp, and support.secondfi.io.

An update for affected wallet holders with an upcoming NIGHT claim Some affected wallet holders are scheduled to claim NIGHT tokens tomorrow. We have been in touch with the Midnight Foundation regarding options for claiming; unfortunately, NIGHT allocations can only be claimed from the original wallet. Claiming from a different, unaffected wallet address is not supported by their system. Because the vulnerability leaves affected wallets permanently compromised, attempting to claim NIGHT to an affected address puts those tokens at risk. For your security, please do not attempt to redeem your NIGHT allocation using an affected SecondFi wallet. Please note: - NIGHT Claim Process: The NIGHT claim process, rules, and redemption mechanism are managed entirely by the Midnight Foundation, a separate organization, and fall outside of SecondFi's control. - Scope of SecondFi Tools: While our Wallet Migration Tool and Asset Recovery Tool are designed to help you recover assets safely, they cannot process or cover the NIGHT claim. If you have questions or wish to inquire about alternative safe claiming options, please contact the Midnight Foundation directly through their official channels. For further details on asset recovery, please visit our Incident FAQ: kb.secondfi.io/en/article/in… Safety reminder: Only rely on links published through our official channels (@secondfiapp and @secondfi_jp).

The progress made so far, and what is left for affected wallet holders.

Security Audit Update: Asset Recovery Tool As we prepare to launch the Asset Recovery Tool for users affected by the security incident, we are providing an update on our technical progress and security review. On 3 August 2026, we engaged @zksecurityXYZ to conduct an independent security audit of our proof-tool repository. Developed for SecondFi, the tool allows users to verify control of a Cardano wallet credential through zero-knowledge proofs, without disclosing private keys or derivation paths. The system is designed to optimize computing and memory requirements so that users can generate proofs directly in their browsers. The project includes custom circuits and prover patches to the consensys/gnark and consensys/gnark-crypto repositories. Audit Results - High-severity issues: zkSecurity identified two high-severity issues in the upstream code. We implemented fixes for both issues, and zkSecurity reviewed, tested, and confirmed that the issues were resolved. - Low-severity issues: Two low-severity issues in the target repository remain open. zkSecurity assessed both issues as not practically exploitable. The complete audit report, including the detailed technical findings, is available here: reports.zksecurity.xyz/repor… About the Asset Recovery Tool - User-initiated: Affected users control when to begin their Recovery Request. - Cardano-first: The tool uses zero-knowledge proof technology to verify wallet control and facilitate the safe recovery of assets without requiring users to provide seed phrases or private keys. Next Steps and Launch Timeline - Smart contract audit: The next testing phase will include a dedicated audit of the recovery smart contract. We will provide a further update when that review is complete. - Production launch: Subject to completion of the remaining audit and final production checks, the Asset Recovery Tool is expected to launch in the coming weeks. - User guidance: We will publish step-by-step instructions and user guides before launch. - Security reminder: Please rely only on information published through SecondFi’s official channels. SecondFi will never ask you to provide your seed phrase or private keys. Our official channels are @secondfiapp and @secondfi_jp on X, and support.secondfi.io