Multiple software wallets are adding address poisoning protection, so we just merged a change to our Wallet Security Ranking checklist: github.com/coinspect/wallet-… Stay tuned for the next testing round 🗣️

Millions have been stolen from weak crypto wallet recovery phrases without public attribution. Big sweeps into single addresses and laundering patterns get detected and reported. Slow, stealthy drains usually do not. Proving the cause requires victims reports, experts, vulnerable wallet versions, bug discovery and reproduction. That has only happened in a few cases, like Milk Sad: milksad.info/

Wallet app patches don't fix weak recovery phrases created years ago. Past attacks covered major chains, English 12-word phrases, and limited derivation paths. AI now makes the long tail searchable by more attackers. Ecosystems need to find and warn at-risk users and help them migrate funds.

If you own a large balance or important access controls on an address generated by a less widely used wallet, rotate your keys, or reach out to @coinspect

When Wallet Cryptography Fails: • Watch for official security notifications • Treat suspected key compromise as seed-level risk • Review every chain tied to the same recovery phrase • Don't reuse or reimport a risky seed • Generate a brand-new wallet and migrate carefully • For large/multi-chain balances, seek expert help before moving funds

If a hardware wallet is not practical for your use case, choose a well-known software wallet with a strong security track record, such as wallets with high scores in our Wallet Security Ranking.

🛡 Recovery Process Update Today, we want to share an update across three areas: ⚙️ Returning user assets ⚙️ Moving user assets safely ⚙️ Onchain recovery 1. Returning User Assets - Drained by the attackers: @emurgo_io has funded an Asset Recovery Wallet specifically to return assets to users whose wallets were compromised in the attack. - Secured through our emergency rescue response: These assets are currently protected and accessible. We are in discussion with @IntersectMBO on the appropriate custody mechanism to ensure they are held securely and returned to users. 2. Moving Your Assets Our initial guidance was to stay put which was a deliberate step while we worked to fully understand the attack vector and avoid exposing users to further risk. Following active discussions with the Intersect Security Council, should you decide to move your assets, we recommend creating a new wallet using a hardware wallet only. A hardware wallet is the most secure option available. Important: However, users should NOT delete the SecondFi app under any circumstances. We strongly advise users to retain BOTH the app and their seed phrase, as they will be required to support the asset recovery process currently underway. 3. Onchain Recovery Our team is actively progressing an on-chain recovery solution designed to support the secure return of user assets. Extensive technical assessment has identified this as the most secure and efficient recovery pathway currently available. We are now working closely with a Cardano community-led task force to develop, validate and execute this solution securely. This process is more complex than originally anticipated and may require additional time beyond our previously estimated 2-week timeline. We will continue providing updates as progress continues. Important Security Reminder: SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. We will never DM you first. Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent. Our official channels are our verified SecondFi X account and support.secondfi.io. For support, please submit a ticket only through our official support channel at: support.secondfi.io Thank you for your continued trust as this work continues.

Use a hardware wallet when possible. Not perfect: blind signing and firmware risk still exist. But constrained hardware keeps whole layers of fragile software complexity away from your keys.

We haven't integrated the latest round of testing results yet because we decided to highlight address poisoning protection. WSR methodology prioritizes attacks that cause users to lose funds. We're not adding new checklist items or changing weights. Instead, we're updating the testing process for the existing "Unknown address detection" check, which now checks whether wallets warn users about unknown recipients and lookalike addresses. All methodology details are public in our GitHub repo.

Supply chain attacks on dApp frontends are becoming more common. Coinspect's dApp Observatory scans thousands of Web3 frontends and tracks their third-party JavaScript dependencies Check it out → coinspect.com/dapps/ (slow load, use the search tool)

Response after discovery: fast action, ownership, and clear communication. The postmortem needs to explain how vulnerable custom cryptographic code reached production. Overall, the response set a higher bar than we usually see in incidents like this.

More wallet drains are being reported that may trace back to weak wallet generation. ⚠️ React Native / Expo wallet devs: do not assume current code proves old wallets were safely generated. Check historical builds and any “secure random unavailable” fixes.

There has been conflicting advice from different community members in an attempt to be helpful. ⚠️ DO NOT RESTORE your recovery phrase into a new Cardano wallet. As advised, do nothing until official steps come from SecondFi. The only thing you should do is submit a ticket at support.secondfi.io. We will never DM you first or ask for your recovery phrase.

To provide more clarity, we have identified the nature of the incident, it is at the address level. The security risk affects wallet users when a transaction is signed. Therefore recovery to another platform or wallet does not mitigate the risk. 🚨 DO NOT restore your recovery phrase into a new Cardano wallet. We have isolated the affected wallets and will post mitigation steps shortly.

Weak randomness does not just put one account or address at risk. It makes every recovery phrase generated through the affected process searchable by attackers. A weak seed stays weak forever. Preliminary notes from our ongoing research: coinspect.com/blog/weak-wall…