Mark RadarMARK RADAR
中 EN
Event File CRYPTO Cryptocurrency Security Cardano

SecondFi Shuts Down After $2.4 Million ADA Theft

2 reports · First detected 2026-07-22 · Last active 2026-07-22

SecondFi, a cryptocurrency wallet service developed by EMURGO for the Cardano ecosystem, allowed users to manage ADA and other on-chain assets. The shutdown matters beyond the project because self-custody wallets depend on secure key generation and transaction signing: a defect in either can expose funds even when the underlying blockchain remains intact. The breach therefore underscores the operational and cryptographic risks facing wallet providers and their users.

SecondFi said on July 22, 2026, that attackers stole about 16.1 million ADA, worth roughly $2.4 million, from 374 wallets between June 21 and June 23. A flaw in per-transaction signature generation could allow private-key material to be derived from public blockchain data. SecondFi patched the vulnerability and secured another 129 million ADA, but will wind down SecondFi and Yoroi. Wallet-export tools are due in early August, followed by a zero-knowledge recovery portal later that month.

All Coverage

2 original reports
PYMNTS.COM 2026-07-23
Crypto Wallet SecondFi Shutters After $2.4 Million Theft
COINDESK.COM 2026-07-22
SecondFi to shut down after $2.4 million ADA wallet theft

The Backstory

The history behind this event
Cardano Wallet SecondFi Exploited, Losing About 16 Million ADA2026-06-27 · 4 reports · similarity 0.86

SecondFi, formerly known as Yoroi, is a self-custody wallet developed by Cardano co-founding entity EMURGO. Its native web wallet's address-generation software contained a deterministic nonce vulnerability that could expose enough information during transaction signing to derive private keys. The incident has also undermined users' confidence in wallet key security.

The attacks occurred from June 21 to June 23, 2026, with SecondFi detecting unusual activity on June 22. Three waves of external attacks drained 374 addresses of about 16 million ADA, worth roughly $2.4 million at the time. The team separately secured about 129 million ADA and placed it in the custody of a qualified third party. On June 27, it announced that it had found a recovery solution and expected to begin returning funds after completing development, testing and review within two weeks.

Mark Radar｜MARK RADAR
Past Issues・by MarkReadFintech
All times are in Taipei time (GMT+8)