Cardano-based wallet SecondFi will shut down its wallet services following a security breach that resulted in the theft of about 16.1 million ADA, valued at roughly $2.6 million.
In an update published on Wednesday, the wallet provider said it will wind down both SecondFi and Yoroi wallet services after an investigation traced the incident to a cryptographic flaw in its wallet software. The breach affected 374 wallets.
An update regarding the recent security incident involving SecondFi
What happened to SecondFi
Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide…— SecondFi (@secondfiapp) July 22, 2026
SecondFi said blockchain intelligence firm Groom Lake conducted an independent investigation and found signs of a sophisticated external attacker, with indicators that may be linked to North Korea’s Lazarus Group. However, the company said no final attribution has been confirmed.
The latest announcement comes nearly a month after the exploit was first disclosed in late June, with affected users still waiting for recovery and migration tools.
SecondFi plans recovery tools as shutdown begins
SecondFi said it is developing a recovery tool based on zero-knowledge proofs that will allow affected users to recover assets while limiting the amount of information they need to share.
According to the company, the tool is still undergoing testing and will be reviewed by an independent security auditor before its planned release in August.
The wallet provider is also building an export feature that will let users migrate their assets to another wallet once available. Although the company outlined its recovery roadmap, it did not announce a reimbursement plan or say whether users who lost funds would be compensated from company reserves.
The latest update also extends the recovery timeline. On June 27, SecondFi said it expected the recovery process to begin within about two weeks after testing and security reviews. The company now expects the tool to launch in August, prompting criticism from users who say they are still waiting for a clear path to recover their funds.
READ ALSO: Taiko Halts Bridge Operations After $1.7 Million Exploit
Did the exploit weaken Cardano’s on-chain governance?
The impact of the breach extends beyond stolen funds, with some observers pointing to its effect on Cardano’s governance ecosystem.
SecondFi, through Yoroi, served as one of the primary gateways for ADA holders participating in Cardano’s on-chain governance. The exploit disrupted access for hundreds of users at a time when the network is advancing governance and scaling upgrades, raising concerns about decentralized representative (DRep) participation and voter coordination.
While the attack did not compromise the Cardano blockchain itself, it weakened confidence in one of the ecosystem’s most widely used wallets. The incident shows how vulnerabilities in wallet infrastructure can affect governance participation even when the underlying blockchain remains secure.
Weak cryptography and recovery efforts guide the network’s response
Security analysts said the breach came from weaknesses in the wallet’s key generation process rather than a flaw in the Cardano network.
According to analysts at BingX, the wallet’s web-based key generator relied on predictable randomness, creating weak entropy during private key generation. Instead of using phishing or malware, attackers were able to mathematically derive private keys from publicly available blockchain data, making the exploit different from most wallet attacks.
The incident has also triggered changes within the Cardano ecosystem. On July 9, EMURGO stepped down from its role in the Pentad group and redirected engineering resources to establish a dedicated asset recovery team focused on returning the stolen ADA.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
