🔒 PingPong Security Update We believe in full transparency with our community, so we want to inform you directly. What happened During a security review on 25 October, we discovered that a server misconfiguration had made certain internal files reachable from the internet. Our logs show that on 15 and 16 October an unauthorized party used this to download our user account file. What was in that file • Email addresses • Linked wallet addresses (public addresses only) • Referral and reward data • Passwords, but only in encrypted form (bcrypt) What was NOT affected ✅ Your coins are safe. PingPong is non-custodial: your funds stay in your own wallet, and we never hold your crypto. ✅ No private keys, seed phrases or exchange API keys were in the affected data. We never ask for or store your seed phrase. ✅ Passwords were never stored in readable form. They are encrypted with bcrypt and cannot be read back. ✅ The PNGP staking contract runs on the BASE blockchain and was not affected. All staked PNGP is safe. ✅ No PNGP rewards were claimed by the unauthorized accounts, and those accounts have been removed. ✅ On our own company trading account, no funds were withdrawn. What we have done • Closed the misconfiguration and blocked all internal files • Replaced all security keys and access tokens • Revoked and replaced our exchange API access • Added extra firewall protection • We are reporting the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) What we recommend • Be alert for phishing. PingPong will NEVER ask for your seed phrase or private key, by email, DM or any other way. • Only use our official site: pingpongcrypto.com • If you used your PingPong password anywhere else, change it there as a precaution. We are sorry this happened. The security of our users and the PingPong ecosystem is our first priority, and we will keep improving it. Questions? Reach out via DM - X account or [email protected] — The PingPong Team