SecondFi to shut down after $2.4 million ADA wallet theft

Breach and Shutdown

Cardano wallet SecondFi is shutting down after a software exploit allowed attackers to steal 16.1 million ADA ($2.4 million) from 374 wallets.

The breach stemmed from a vulnerability in transaction signing software that enabled the derivation of private keys from blockchain transaction data.

SecondFi, which replaced EMURGO’s Yoroi wallet, said it will not resume normal operations despite patching the vulnerability - and at the time securing 129 million ADA before attackers could reach the funds.

The flaw allowed attackers to derive private key material from transaction data visible on the Cardano blockchain, SecondFi said. The Cardano network itself was not compromised, and hardware wallet users were not affected.

Investigation and Attribution

Groom Lake, the blockchain intelligence firm hired by EMURGO, found that the main attacker was sophisticated and well-funded. Some indicators point to North Korea’s Lazarus Group, though no attribution has been confirmed, the firm said. A separate attacker targeted another set of wallets during the same period.

Recovery Efforts

SecondFi expects to release wallet export tools in early August and a zero-knowledge recovery portal later that month. EMURGO has funded an asset recovery wallet, but no firm distribution date has been given.

• 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 10

TRON Q2 Metrics

In Q2; TRON's stablecoin dominance rose to 28.7%, USDT supply on TRON hit $89B ATH, $89M in protocol fees (2nd to Hyperliquid), TRX +3%, and deepening institutional & agentic reach.

In Q2; TRON's stablecoin dominance rose to 28.7%, USDT supply on TRON hit $89B ATH, $89M in protocol fees (2nd to Hyperliquid), TRX +3%, and deepening institutional & agentic reach.

Why it matters: In Q2; TRON's stablecoin dominance rose to 28.7%, USDT supply on TRON hit $89B ATH, $89M in protocol fees (2nd to Hyperliquid), TRX +3%, and deepening institutional & agentic reach.