secondfi

Cardano ecosystem wallet SecondFi stated that approximately 16.1 million ADA were stolen due to a vulnerability in the wallet software, valued at about 2.6 million USD. The platform will gradually shut down SecondFi and Yoroi wallet services. This incident affected 374 wallets.SecondFi indicated that an independent investigation by blockchain intelligence agency Groom Lake identified the attacker as a sophisticated external actor and found indicators possibly related to North Korea's Lazarus Group, but attribution has not yet been confirmed. SecondFi is developing a recovery tool based on zero-knowledge proofs to help affected users recover their assets and limit the information that needs to be shared. The tool is still in testing and will undergo third-party auditing before its planned release in August. SecondFi is also preparing a wallet export feature that allows users to migrate their assets to other services. The platform has not announced a direct compensation plan and has not specified whether it will use its own funds to compensate users.

The governance company of Cardano, Intersect, stated on the X platform that EMURGO is unable to allocate the necessary resources to execute the Token2049 event due to its recent focus on handling the SecondFi security incident. After discussions among three parties, the responsibility for the event has officially been transferred to the Cardano Foundation.EMURGO submitted a transfer request to Intersect, which received agreement from all parties after discussions with the Cardano Foundation. Intersect stated that this decision was based on the urgency of the event timeline and the need to avoid delivery uncertainties. The Cardano Foundation has agreed to deliver the event within the approved scope, and both EMURGO and Intersect recognize its past execution capabilities. The delivery work for Token2049 has now officially been handed over, and the event is still scheduled to take place in October.Previously, in June, it was reported that SecondFi disclosed a security incident affecting approximately 16 million ADA (around 2.42 million USD at the time); however, SlowMist indicated that user losses from SecondFi could exceed 20 million USD.

Cardano wallet service provider SecondFi released the latest update on the theft incident, stating that "isolation mode" will be launched this week, allowing users to check if their wallet addresses are involved in the related incident and submit tickets; next week, they plan to introduce a secure wallet export feature to provide a safer wallet migration path for users of different technical levels.SecondFi reiterated that it will provide potential asset recovery solutions for wallets confirmed to be affected through the process, expected to use a zero-knowledge proof-based recovery tool with set qualifications and terms; the official also reminded users that they will not request private keys or mnemonic phrases, and users should only operate through official website support and designated verification tools.

The founding entity of Cardano, EMURGO, stated on Monday that the wallet service SecondFi, which was hacked, will not resume normal operations even after a security audit is completed, and requires all users to migrate their assets through the official recovery process. SecondFi is a rebranded version of the Yoroi wallet, which EMURGO claims is the largest wallet provider for Cardano.According to EMURGO's incident report on June 25, the service suffered four independent wallet theft incidents on June 22, with 374 addresses compromised and approximately 16 million ADA (worth about 2.4 million USD at the time) stolen. The team also managed to secure approximately 129 million ADA through emergency measures.EMURGO stated that the compromised wallets should be considered permanently exposed at the address and private key level, and restoring the compromised mnemonic phrases to other wallets does not eliminate the risk. EMURGO plans to launch an isolated wallet status check tool this week, followed by providing a secure export tool and an offline migration workshop in Tokyo, and is building a special repair fund for on-chain recovery systems, which will return assets to affected users after external audits are completed.

Cardano wallet service provider SecondFi released the latest update on the theft incident, stating that the team has completed the final balance snapshot of affected users' assets. Previously, multiple snapshots were continuously recorded during the incident response as a basis for subsequent asset recovery and verification.SecondFi stated that the engineering and security teams are advancing the asset recovery plan, with the expectation that asset returns could begin in about two weeks. One week will be used to reach a feasible technical solution, and one week will be used for testing and review, with specific timing potentially adjusted as progress is made. The platform will resume operations only after passing a comprehensive security review. Currently, users only need to submit support requests through the official website ticketing system, with no additional actions required.

Cardano wallet service provider SecondFi stated that it has identified the root cause of the recent security incident and has deployed patches for the unaffected wallets, and will soon resume normal operations. SecondFi disclosed that there were a total of 4 incidents of funds being transferred out, of which 3 were carried out by external attackers, resulting in approximately 16 million ADA being transferred from 374 addresses. To reduce further losses during the ongoing attacks, SecondFi initiated an emergency transfer, moving approximately 129 million ADA to an independent third-party custodian for safekeeping, and has hired an external accounting firm for a special audit to facilitate subsequent verification and return assets to the affected addresses. SecondFi advises affected users to submit claims through the official support page and currently not to import their mnemonic phrases into other Cardano wallets, as the security risk occurs at the address and signature level.

Regarding the recent security incident of the Cardano ecosystem project SecondFi, Slow Mist founder Yu Xian stated: "I am actually quite unfamiliar with the Cardano ecosystem. I observed for a whole night, but if the addresses starting with addr1q are both hacker addresses (which they should be based on behavior), the losses for SecondFi users should exceed 20 million dollars (over 129 million ADA and other tokens stolen)."Previously, it was reported that SecondFi disclosed that the security incident affected approximately 16 million ADA, with the issue originating from the web wallet generation software.

SecondFi posted on platform X that the team discovered security issues with a small number of Cardano wallets on the platform. The issue has been contained and affected features have been suspended, while the engineering team is actively working to restore all platform functionalities. To protect users, SecondFi has temporarily entered maintenance mode, and all front-end interactions have been suspended.