https://xitter.cf/t.co/UssZxHjl3y / Tech Janitor 💻🖥🧼🧹 VFS, ZAM - Cardano Keystone Wallet Ambassador
Bangor, Northern Ireland
Joined November 2021
- Tweets19.4K
- Following3.2K
- Followers2.8K
- Likes31.4K
Johnny Kelly ($intertreejk) retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
Johnny Kelly ($intertreejk) retweeted
Tbh, the Ledger incident has shaken all of us and raised serious concerns about self-custody.
Amid all this, we've also seen people wondering if there's a worthy alternative to Ledger, with some even considering giving up on self-custody altogether.
That's why we started sharing tweets highlighting the advantages of our product over Ledger, without speaking ill of them. We wanted to help people understand their options at a time when they needed them most.
We don't think there's anything wrong with that, as long as we're factual and respectful.
Johnny Kelly ($intertreejk) retweeted
IceBreakers is closing. Operators can turn their nodes off.
When we started, a community-run network serving real Cardano traffic was a theory. Over 100 operators proved it works, and works at scale.
Thank you, everyone 💙
Johnny Kelly ($intertreejk) retweeted
For anyone who had not migrated their monitoring setups prior to 11.1.1 and 11.1.2, check out the "new tracing system" quick start guide here: developers.cardano.org/docs/…
The old system was finally completely removed in 11.1.1 and above after a progressive switch over the past year.
Johnny Kelly ($intertreejk) retweeted
We're live now with No Agenda episode 1888 #@pocketnoagenda l.curry.com/fV0
Johnny Kelly ($intertreejk) retweeted
John C. Dvorak
April 5th, 1946 - July 20th, 2026
mailchi.mp/nashownotes/rip-j…
Johnny Kelly ($intertreejk) retweeted
🚨ÚLTIMA HORA: KFC dejará de ofrecer su formato físico a partir de hoy.
Sus productos solo se podrán consumir a través de su app en formato falso png.
Johnny Kelly ($intertreejk) retweeted
Fintech twitter is awesome, but there is nothing better on this app right now than the backlash against PlayStation announcing they will no longer make physical media
Johnny Kelly ($intertreejk) retweeted
The proposal to make Blockfrost a free, community-governed access layer is now live on chain 🥳
DReps, Builders and community members, please read it, see what changed and vote. Link below 👇
Johnny Kelly ($intertreejk) retweeted
SecondFi security issue wasn't a nonce reuse, or a weak key, but a public nonce used to sign keys. The Ed25519 standard defines how you are supposed to generate nonces, using a secret prefix. SecondFi didn't have a secret prefix at all, meaning anyone could derive the nonce by just seeing a signed transaction.
Rolling your own crypto code is dangerous, I'm guessing the wallet wasn't audited, resulting in this problem going undetected.
Read more at Tibane: tibane.net/research/secondfi…
Johnny Kelly ($intertreejk) retweeted
What I *can* do is share what steps *I* took to ensure my funds were safe.
The website below was built by someone I trust. It connects to your wallet, reads your wallets public addresses, and scans publicly available data to determine if those addresses are impacted.
is-my-cardano-safu.vercel.ap…
I connected each of my wallets to this to see which were impacted. For most of them, no private key was leaked, and the safest thing for me to do was to disable the SecondFi app and wait for the bug to be patched.
For one wallet, which I use for testing, it identified that the key was already leaked, and funds were at risk. I recovered my seed phrase into another wallet (Eternl), created a *second* brand new account. I then sent all funds (including native tokens) from the compromised wallet to the new wallet. I reviewed the transaction carefully, including all "outputs", to make sure there was no "change address" returning funds back to the first wallet, which could have put them at risk of being swept by an attacker.
Johnny Kelly ($intertreejk) retweeted
🛡️ If you’re using SecondFi (formerly Yoroi), here’s what you need to know.
⚠️ SecondFi has advised users to wait and not restore their existing recovery phrase into another wallet.
👉 However, because this guidance comes from the same team responsible for the affected wallet, I personally chose a different approach.
I restored my wallet using this method and have not experienced any issues. I even intentionally left some ADA in the original wallet to see whether it would be taken, and so far, it has not been.
❌ Do NOT open the SecondFi wallet, and absolutely do NOT sign anything from it.
✅ 1. Buy a hardware wallet (Keystone, Ledger, or Trezor).
✅ 2. Download a trusted Cardano wallet like VESPR if you want to keep it simple, or Eternl if you prefer more advanced features.
✅ 3. Add a new wallet by connecting your hardware wallet, or, if you can’t wait, create a new software wallet with a NEW recovery phrase and transfer to your hardware wallet later.
✅ 4. Restore your Yoroi/SecondFi recovery phrase in a new wallet app (VESPR, Eternl, etc.). This will give you access to your existing wallet so you can transfer your funds.
✅ 5. Transfer your ADA and other tokens from your restored (old) wallet to your new wallet.
✅ 6. Delegate to a single pool operator like BBHMM.
❌ Definitely do NOT pick EMUR# or YOROI pools.
🙏 If you did lose funds, the only thing you can do is open a ticket directly with SecondFi support.secondfi.io/
⚠️ *Ignore DMs, fake support accounts, and recovery websites. Never share your recovery phrase with anyone
Stay safe out there fam.
Johnny Kelly ($intertreejk) retweeted
SecondFi's advice wasn't just wrong. It kept users exposed for longer while protecting SecondFi interests.
They told people: don't restore your seed into another wallet, and the risk is signing a transaction.
What was actually true:
▸ Restoring your seed into another wallet did nothing to your keys. A normal wallet signs safely.
▸ Your key was already FULLY exposed the moment you signed once in SecondFi. That signature was the leak.
▸ Signing again, from any other wallet, revealed nothing new and gave the attacker nothing.
So the one move that could save you, restore elsewhere and get your funds out, was the exact thing they warned against.
"Sit still and wait" served them, not you.
Full breakdown soon.
The attack was not "highly sophisticated" and knowing now how it happened, it would have always been safe to restore your seed phrase into a competently developed wallet and transfer your own funds to a newly generated seed phrase.
The move to secure funds already at risk was probably the right move as much as it sucks for those affected to now be left in limbo wondering how or when they'll get their assets back.
There is no "vulnerability" in Cardano address standards or seed generation methods or transaction signing methods when they are implemented properly.
