- SecondFi is shutting down after losing $2.4 million in a recent exploit.
- A security firm flagged a link to North Korea’s Lazarus Group in the incident.
- The team expects to begin the users’ asset recovery process in early August.
Cardano wallet SecondFi is being shut down weeks after the service suffered a major exploit, resulting in the loss of 16.1 million ADA, about $2.4 million.
SecondFi announced the decision on Wednesday, despite ongoing efforts to reimburse users affected by the attack, around 374 wallets.
An update regarding the recent security incident involving SecondFi
— SecondFi (@secondfiapp) July 22, 2026
What happened to SecondFi
Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide…
Groom Lake flags link to North Korean hackers
The developer EMURGO contracted an external security firm, Groom Lake, to investigate the incident. Groom Lake found that two separate attackers were involved in the incident, with the first being “well-funded, with indicators consistent with activity by a professional, state-aligned threat actor.”
“Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group,” SecondFi wrote.
The root cause of the exploit was traced to how the wallet software generated per-transaction signatures. The flaw allowed the attackers to derive private key material from information visible on the public chain.
The flaw has been patched. However, SecondFi and Yoroi wallets are to be discontinued “given the gravity of this event,” the team wrote.
SecondFi says recovery efforts continue
Not all the user funds reached the attackers. SecondFi was able to secure roughly 129 million ADA before it could be touched, and those funds are now held for recovery.
SecondFi took a final balance snapshot on June 26 to begin processing refunds for affected users, as Cryptopolitan reported.
The team revealed they are now testing a zero-knowledge (ZK) proof portal that will allow users to safely recover their assets, while limiting the information required to do so. The plan includes wallet export functionality, with both expected to be released early in August 2026.
“We are engaging a specialist third-party auditor to review it before its anticipated release in August 2026,” SecondFi said.
Prior to the SecondFi closure decision, EMURGO, which is also one of the founding organizations of the Cardano blockchain, stepped down from its role in Cardano’s Pentad governance group, saying the SecondFi recovery process is an “immediate priority.”
Today, we formally notified the entities that we will be stepping down from our duties as a member of the Pentad. We want to thank the members for their shared commitment to Cardano throughout our time working alongside them.
— EMURGO (@emurgo_io) July 8, 2026
Our immediate priority is the @secondfiapp recovery…
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
How much was stolen from SecondFi and how many wallets were hit?
Attackers took roughly 16.1 million ADA, about $2.4 million at the time, from 374 wallets, according to SecondFi, though SlowMist initially estimated losses could reach as high as $20 million.
Why does SecondFi tell users not to restore their seed phrase in another wallet?
Because the vulnerability sits at the address level rather than in the app, importing a compromised recovery phrase elsewhere keeps the keys exposed, and signing any new transaction from an affected address could let attackers drain the funds again.
Who is believed to be behind the SecondFi attack?
Groom Lake, the firm EMURGO hired to investigate, said the main attacker was sophisticated and well-funded, with some indicators pointing to North Korea's Lazarus Group, but no attribution has been confirmed.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Ibiam Wayas
Ibiam Wayas has covered the crypto news beat since 2019. He studied Computer Science at National Open University of Nigeria. His work has appeared on various crypto news platforms, including Coinfomania, Crypto News Australia, and AltcoinBuzz. Drawing on his background in Computer Science, he now focuses on crypto, robotics, and longevity news.
