SecondFi is shutting down after losing $2.4 million in a recent exploit

Cardano wallet SecondFi is being shut down weeks after the service suffered a major exploit, resulting in the loss of 16.1 million ADA, about $2.4 million.

SecondFi announced the decision on Wednesday, despite ongoing efforts to reimburse users affected by the attack, around 374 wallets.

An update regarding the recent security incident involving SecondFi

What happened to SecondFi
Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide…

— SecondFi (@secondfiapp) July 22, 2026

Groom Lake flags link to North Korean hackers

The developer EMURGO contracted an external security firm, Groom Lake, to investigate the incident. Groom Lake found that two separate attackers were involved in the incident, with the first being “well-funded, with indicators consistent with activity by a professional, state-aligned threat actor.”

“Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group,” SecondFi wrote.

The root cause of the exploit was traced to how the wallet software generated per-transaction signatures. The flaw allowed the attackers to derive private key material from information visible on the public chain.

The flaw has been patched. However, SecondFi and Yoroi wallets are to be discontinued “given the gravity of this event,” the team wrote.

SecondFi says recovery efforts continue

Not all the user funds reached the attackers. SecondFi was able to secure roughly 129 million ADA before it could be touched, and those funds are now held for recovery.

SecondFi took a final balance snapshot on June 26 to begin processing refunds for affected users, as Cryptopolitan reported.

The team revealed they are now testing a zero-knowledge (ZK) proof portal that will allow users to safely recover their assets, while limiting the information required to do so. The plan includes wallet export functionality, with both expected to be released early in August 2026.

“We are engaging a specialist third-party auditor to review it before its anticipated release in August 2026,” SecondFi said.

Prior to the SecondFi closure decision, EMURGO, which is also one of the founding organizations of the Cardano blockchain, stepped down from its role in Cardano’s Pentad governance group, saying the SecondFi recovery process is an “immediate priority.”

Today, we formally notified the entities that we will be stepping down from our duties as a member of the Pentad. We want to thank the members for their shared commitment to Cardano throughout our time working alongside them.

Our immediate priority is the @secondfiapp recovery…

— EMURGO (@emurgo_io) July 8, 2026

The smartest crypto minds already read our newsletter. Want in? Join them.