Tom - NIMUE

Cardano - Bitcoin - Midnight 💙🧡🖤
SPO Nimuë Lady of the Lake Pool - DRep
Midnight Ambassador Nightforce Bravo

[Tom - NIMUE @Tom_Nimue]

Stake Pool account @nimuepool suspended atm 😢Apparently we’re not authentic...

[Tom - NIMUE @Tom_Nimue]

@SebastienGllmt Advertising the account’s public key like this will also compromise ALL private keys at a lower level, even if only one address under it is compromised. So you should only do this after moving all funds out of the account, even the not yet compromised addresses.

[Tom - NIMUE @Tom_Nimue]

@phil_uplc @kenerik Technically someone could’ve also signed a CIP-8 message with SecondFi that also would’ve leaked the key, right? Which can’t be checked by this app… 😕

[Tom - NIMUE @Tom_Nimue]

@Quantumplation @cardanomosh If a tx signed with Yoroi could also expose the private key, it means the code on their GitHub isn’t the code actually used in the app.
That’s also problematic…

[Phil 🪏 @phil_uplc]

Here is a webapp I wrote to facilitate safe migration of wallets that I have been sharing with users I verified as impacted since the original incident occurred.

My legal counsel finally gave approval to publish the tool publicly:
https://t.co/XV7pX8MTmM

You can use "Get Me Outta Here", and it will handle the corner cases that can result in loss of funds.

Note that the tool is use at your own risk, it performs the safe migration handling the known edge-cases, however it doesn't guarantee comprehensiveness and there may be uncovered edge-cases that even this tool is not equipped to handle.

[Tom - NIMUE @Tom_Nimue]

@leemolou @adamKDean The problem wasn’t with the seed generation though, but with creating the tx witnesses.

[Lozza @lozzaclay]

9 days left.
52%.

If you believe Cardano needs faster finality, don't just assume everyone has seen the proposal.

let's get Peras to mainnet.

Tag your DRep below if they haven't voted yet.

@tweagio needs your support !

[Tom - NIMUE @Tom_Nimue]

It’s not too late the submit a treasury withdrawal as we don’t know yet which live proposals will get approved and a TWGA submitted today could already be ratified the next epoch…

The NCL could also be exceeded though with the right timing of events. If multiple proposals are about the be ratified at the same epoch boundary and none of them would individually violate the NCL, together they can as the ledger doesn’t enforce the NCL.

[EMURGO @emurgo_io]

https://t.co/19PlJ1BTBS

[SecondFi @secondfiapp]

Important Security Update.
As stated, we have identified the root cause of the incident. It is at the address level.

The affected software signer used a deterministic nonce derivation flaw. Every time an address signed a transaction, it leaked enough information to mathematically reconstruct that address's private key from public blockchain data alone.

If you were affected by the attack, your first/default address (index 0) is almost certainly exposed. It is the address that some wallets may be using by default or as the only address at all, and nearly always has transactions. That history is all an attacker needs.

Please DO NOT RESTORE your recovery phrase into another Cardano wallet. This does not mitigate the security risk.

Your keys are derived from your recovery phrase, not from the app. Restoring the same phrase into another wallet recreates identical addresses with identical exposure. The compromised thing is the key of the compromised address(es), not the interface you are using.

If you were affected by the attack, and use any of your compromised address(es) to deposit it could be drained again. This includes withdrawing staking rewards even using another wallet.

Reward withdrawal and delegation are signed with the stake credential. The withdrawn funds could be routed to your first/default address (as indicated above), which has a high chance of being compromised (wallets work differently managing it). Mempool-monitoring adversaries can front-run or sweep your assets on confirmation.

There has been conflicting advice from community members in an attempt to be helpful. Do nothing until official steps come from SecondFi.

We are working to facilitate the verification process so users can claim back their assets safely. Following the above is very important, if not it makes verified claims more difficult.

The only thing you should do right now is submit a ticket at https://t.co/bKfl8SK9D2

We will never DM you first or ask for your recovery phrase.

[Tom - NIMUE @Tom_Nimue]

Nice idea and better what we have now, but lately the idea of having different categories came up, to allow for e.g. investing with the treasury in liquidity without this having an impact on spending for other projects.
How could this be incorporated in this system?
Also, it doesn’t make much sense to me to apply the same NCL percentage to all assets in a multi asset treasury.
Converting treasury ada to stables needs a withdrawal first too btw, which would also fall under that ‘investing’ categorie…
I think abolishing the NCL is still the best solution…

[Tom - NIMUE @Tom_Nimue]

@therealdisasm @Hornan7 @Cerkoryn @adamKDean @EPOCHpool @maureenyam @sde_laney @kenerik @TevoSaks @FannyFNY_ @Tom_Voltaire Pollo Hawaï ftw!!

[Tom - NIMUE @Tom_Nimue]

@Hornan7 @Cerkoryn @adamKDean @EPOCHpool @maureenyam @therealdisasm @sde_laney @kenerik @TevoSaks @FannyFNY_ @Tom_Voltaire You don’t eat pineapple pizza? Well, I guess it’s your own choice not wanting to enjoy life…

[Tom - NIMUE @Tom_Nimue]

@ManuelOnchain Certainly not the users whose funds were confiscated by SecondFi… 😅

[Tom - NIMUE @Tom_Nimue]

@TheRefreshCNFT @_ThisCr8zyLife_ You too?! Same happened to my account @nimuepool! Appealed it 4 times now, whereafter I got a message there was no violation and account has been restored, but nothing changed, still suspended. Wonder if you experience the same…

[Tom - NIMUE @Tom_Nimue]

@HukAleksandra Nice to see you’re still here though

[PALM Economy @palmeconomy]

The power of ecosystem collaboration

What makes the https://t.co/JJObGr7puR treasury proposal uniquely strong is that it is not a single entity project by a single , but a massive consortium of industry leaders combining their expertise to drive real-world utility on the Cardano Mainnet.

We are proud to bring together an incredible network of partners to make this vision a reality.

🟢Field Distribution & Scale: @SyngentaIND via Project Swaminathan, alongside the Global AE Academy (co-founded with @IFC_org, SAFIA, and @corteva)

🟢Technical Cohort:
DigiFarm (AI satellite imagery), Veridian (decentralized identity), @nmkr_io (tokenization), and robust smart contracts built by AIQuant and @AnastasiaLabs

🟢Application Paths: @andamio_teams (AE certification and reputation), @ZengateGlobal (traceability and EUDR compliance), and @Seedstars SIGMA (credit scoring and stablecoin loan infrastructure)

🟢Stewardship & Governance: https://t.co/JJObGr7puR Foundation as the neutral steward, with @Elkconnect_web3 GMBH and HashPoint Consulting handling technical coordination utilizing the battle-tested treasury smart contract framework developed by @SundaeLabs.

This is what an unusually strong, multi-country public good looks like. We have the tech, the partners, and the scale. "We sincerely apologize if we missed mentioning any partner or could not tag your handle due to search limitations on X!"

Time is running out (less than 16 hours), so please cast your YES vote today! Find the link in the first comment below.

[Dan Gambardello @dangambardello]

🚨 Cardano was NOT hacked. Full stop.

The drains you’re seeing happened in SecondFi (ex-Yoroi) wallet software, a flaw in their key generation, not the Cardano blockchain.

[AdaStat.net 💎 Cardano Explorer • SPO • DRep @ada_stat]

Looks like we have our first ratified RWA proposal!

Congratulations to the team and to the #CardanoCommunity on this milestone 🎉

[Daniel Friedman ₳Σ 🇺🇸🇯🇵⛩️ @DanielTetsuyama]

THE GREAT ONBOARDING BEGINS!

https://t.co/7fw4ll4Ggj PROPOSAL HAS PASSED!

Thank you to everyone who supported the team and helped get this over the line.

Huge congratulations to @YoramBenzvi & team.

NOW LET'S GET TO WORK!

[Pete | Beware of Scammers @astroboysoup]

The SecondFi incident has been painful for us on Cardano for sure. But it is mixed in with some brilliant and positive news:

- @IOGroup Leios live on Testnet, scaling is coming by the end of the year.
- DApps like @strikeperps @DanoFinance @surfcardano @ATLAS_DEFI_ @AscendPerps killing it atm
- Bitcoin DeFi w/ @CswapDEX @FluidTokens @SundialProtocol @CharmsDev
- @DraperDragon VCs @OrionFund applications open for their Cardano Program
- @alphagrowth1 is creating products that will help increase Cardano activity, TVL and boost DeFi

I know it's hard to stay positive sometimes, but we really need to. There are a lot of great things coming this year.