You emailed your investors before you knew any details of the vulnerability telling them that they were safe.

You were wrong.

Once you knew about the vulnerability you denied it because you couldn't reproduce it in your badly coded simulation.

You were wrong again.

So what makes you think that you're qualified to say "Investors are safe" now? And why should they believe you when you have shown yourself to be generally clueless?