🛡️ Recovery Process Update
Our team remains focused on returning assets to affected users, and we are making strong progress on a structured recovery and verification process.
Two important updates today:
1. The final balance snapshot has been taken today, Friday 26 June 2026. We have been capturing regular snapshots throughout the incident response, and this final one gives us an accurate, verified record of balances to work from as we prepare recovery.
2. Timing of recovery. Behind the scenes, our engineering and security teams have worked around the clock to validate balances and evaluate recovery mechanisms. This has led to a solution where assets can begin being returned, which we estimate is around two weeks away: roughly one week to reach a working solution, then a week of testing and review. Timing may shift as the work continues but our priority is clear: a safe return of funds and getting SecondFi back online responsibly.
We will resume operations once we are fully confident the platform is secure and all security reviews are complete and we are determined to get there as quickly as we safely can.
For now, the only action required is to submit a support ticket at: https://t.co/bKfl8SK9D2.
We appreciate your continued patience as we work through this process responsibly and will continue sharing updates as progress is made.
I've begun experimenting how to develop a recovery smart contract that can vend out from a pool of Ada and CNTs using a zero knowledge proof of possessing the 24 keywords that generate a wallet. I'll sync with @Quantumplation@SebastienGllmt and the Midnight team on what is discovered.
My SecondFi / Yoroi Incident
I want to share my personal experience regarding the recent SecondFi / Yoroi incident.
My seed phrase was originally generated in Daedalus Wallet, not in Yoroi or SecondFi. I later imported that wallet into Yoroi and had been using it for a long time without any issue.
However, after I opened the app yesterday, it automatically updated to SecondFi. Shortly after the update, my assets were transferred out without my authorization.
This is why I believe the issue may not be limited to newly generated wallets or simply someone guessing seed phrases. In my case, the seed phrase was generated by Daedalus and the wallet was only imported into Yoroi.
If other users with imported wallets were also affected, then the incident may involve the updated wallet app, imported wallet handling, local key storage, wallet unlocking, or the signing process after the update.
I hope SecondFi / EMURGO can clearly explain whether imported wallets were also at risk, what exactly happened after the update, and what affected users should do next.
I am sharing this to help other users understand that this may not be only a “new wallet generation” issue. More transparency is urgently needed.
@secondfiapp@emurgo_io
Reminder: Until the SecondFi incident is fully resolved, please avoid making any transactions with addresses that have interacted with SecondFi.
This includes transfers, staking reward claims, unstaking, swaps, claims, approvals, or any action that requires a wallet signature.
If you have used SecondFi for trading, signing, authorization, or other wallet interactions, your address may potentially be affected.
The risk is not necessarily tied to the wallet app itself. Even if you switch to another wallet app, restoring the same recovery phrase may still give you the same addresses.
If an affected address signs a transaction, it may trigger asset movement or expose the assets to further risk.
Please wait for SecondFi to officially announce a safe migration, claim, or asset return process before taking action.
Important Security Update.
As stated, we have identified the root cause of the incident. It is at the address level.
The affected software signer used a deterministic nonce derivation flaw. Every time an address signed a transaction, it leaked enough information to mathematically reconstruct that address's private key from public blockchain data alone.
If you were affected by the attack, your first/default address (index 0) is almost certainly exposed. It is the address that some wallets may be using by default or as the only address at all, and nearly always has transactions. That history is all an attacker needs.
Please DO NOT RESTORE your recovery phrase into another Cardano wallet. This does not mitigate the security risk.
Your keys are derived from your recovery phrase, not from the app. Restoring the same phrase into another wallet recreates identical addresses with identical exposure. The compromised thing is the key of the compromised address(es), not the interface you are using.
If you were affected by the attack, and use any of your compromised address(es) to deposit it could be drained again. This includes withdrawing staking rewards even using another wallet.
Reward withdrawal and delegation are signed with the stake credential. The withdrawn funds could be routed to your first/default address (as indicated above), which has a high chance of being compromised (wallets work differently managing it). Mempool-monitoring adversaries can front-run or sweep your assets on confirmation.
There has been conflicting advice from community members in an attempt to be helpful. Do nothing until official steps come from SecondFi.
We are working to facilitate the verification process so users can claim back their assets safely. Following the above is very important, if not it makes verified claims more difficult.
The only thing you should do right now is submit a ticket at https://t.co/bKfl8SK9D2
We will never DM you first or ask for your recovery phrase.
@SunnyPunkNoir I did not use the web wallet. My last transaction was through the mobile app (SecondFi), where I only transferred NIGHT tokens to an exchange. That was on Jun 9, 2026 at 3:07:21 PM UTC+8, about 15 days before the unauthorized transfer.
⚠️ As stated, we have identified the root cause, it is at the address level. Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.
In addition, we are working to facilitate the verification process so users can claim back their assets safely so the above is very important, as it makes claims more difficult.
There has been conflicting advice from different community members in an attempt to be helpful. Do nothing until official steps come from SecondFi.
The only thing you should do is submit a ticket at https://t.co/bKfl8SK9D2.
We will never DM you first or ask for your recovery phrase.
Cardano DeFi has the community, the security, and the infrastructure, so why is liquidity still the missing piece?
@alphagrowth1 thinks they have the blueprint to unlock $200,000,000 in TVL through their "Cardano Prime" proposal.
But with a massive treasury ask on the table, the community needs to see the proof.
I pushed them on their 3-phase plan, timeline, and how the funds will actually be controlled.
Is this the catalyst Cardano DeFi needs, or is it too big of an ask?
Very good news for everybody affected!
Majority of funds were a white hack, so they can be returned through an official support ticket (careful for scammers!)
> 129m+ ADA continues to be routed to an independent, custodian, where they are held securely
UPDATE: The SecondFi hackers stole 16M $ADA from 374 addresses.
The earlier mentioned 129M $ADA was RESCUED by EMURGO and will be returned to users.
This is great news.
They've also repeated: "Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction."
As per our previous post:
https://t.co/LGhovIoI3T
We have identified the root cause and have since rolled out a patch for all unaffected wallets. This will allow us to resume normal operations soon.
-----
Regarding affected wallets, 4 distinct draining events occurred. 3 were executed by external threat actors, resulting in a loss of ~16m ADA across 374 addresses.
To prevent total loss during the active exploit, emergency rescue measures were triggered to secure the available ~129m ADA and continues to be routed to an independent, qualified third-party custodian, where they are held securely for the benefit of the affected wallet addresses.
An external accounting firm has been engaged for a special audit to independently verify those holdings.
We are working to facilitate the verification process so users can claim back their assets safely. Affected users should submit their claim at https://t.co/bKfl8SK9D2
We take this incident seriously and are working to ensure all assets are returned to affected users as soon as possible.
As stated, we have identified the root cause, it is at the address level. Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.
Further explanation to follow.
To anyone that is tracking the funds from the SecondFi hack:
Our API might be really helpful for building custom trackers and visualization tools for the inflows / outflows of the hacker's address.
Below is an example what Claude could build in just a few minutes with the API.
Seems like total of 129.5M $ADA was stolen from 2593 users.
Just putting it out there in case someone's looking for a data source. Hoping this could be helpful.
We're sorry to all the affected users, hoping the situation gets swiftly resolved with the funds returned.
Fingers crossed.