A devastating security incident has rocked the Cardano network, leading to the theft of over 16 million ADA tokens from user wallets, which could amount to up to $20 million in losses. This significant breach has been traced back to compromised seed phrases within the SecondFi wallet, raising alarms across the crypto community.
What Went Wrong?
The crux of the issue lies with SecondFi, a pivotal self-custody wallet for Cardano users, overseen by Emurgo Labs. Having recently rebranded from Yoroi on June 12, SecondFi’s vulnerabilities emerged shortly after this transition. This timeline suggests potential flaws within the foundational infrastructure leveraged by Cardano’s developers rather than external interference.
How Are Users Being Alerted?
SecondFi has undertaken measures to identify and quarantine compromised addresses. Nevertheless, the company strongly advises users to uninstall the application and any related browser extensions. They recommend migrating assets to hardware wallets to enhance security, as the company has only paused activities on its own interface.
The SecondFi team announced that the incident occurred at the address level and that the risk was triggered when a transaction was signed. They stressed that simply transferring a seed phrase to another wallet would not resolve the issue and urged users to move their assets to a different type of wallet as quickly as possible.
Research indicates an expansive vulnerability affecting all private keys generated through SecondFi. Analysts have pinpointed the company’s own wallet creation software as a possible source of the breach.
Who Is Behind the Breach?
Numerous losses have been reported, revealing active attacker addresses as of June 24. Although illicit transactions have recently halted, analysis indicates that stolen NFTs were diverted to a separate wallet. Investigations also suggest the attacker might have unlawfully acquired a database containing private keys.
- The hacker’s address was operational from June 24.
- The attack leveraged a compromised database of private keys.
- Investigators believe initial funding for the attacker came via Binance, providing a potential lead.
Cardano’s native currency ADA saw its price dip by 2.9%, hitting $0.15. Once valued at $0.42 in early 2026, ADA’s value has plummeted over 54% year-to-date. The incident sparked discussions within the community about potentially using the Cardano treasury’s reserves, totaling 352.4 million ADA, to compensate victims, yet no concrete plans have been implemented.
