As per our previous post:
x.com/secondfiapp/st…
We have identified the root cause and have since rolled out a patch for all unaffected wallets. This will allow us to resume normal operations soon.
-----
Regarding affected wallets, 4 distinct draining events occurred. 3 were executed by external threat actors, resulting in a loss of ~16m ADA across 374 addresses.
To prevent total loss during the active exploit, emergency rescue measures were triggered to secure the available ~129m ADA and continues to be routed to an independent, qualified third-party custodian, where they are held securely for the benefit of the affected wallet addresses.
An external accounting firm has been engaged for a special audit to independently verify those holdings.
We are working to facilitate the verification process so users can claim back their assets safely. Affected users should submit their claim at support.secondfi.io
We take this incident seriously and are working to ensure all assets are returned to affected users as soon as possible.
As stated, we have identified the root cause, it is at the address level. Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.
Further explanation to follow.
To provide more clarity, we have identified the nature of the incident, it is at the address level. The security risk affects wallet users when a transaction is signed.
Therefore recovery to another platform or wallet does not mitigate the risk.
🚨 DO NOT restore your