EMURGO Confirms SecondFi Hack Leading Cardano Asset-Recovery Push

HypeMeter

Steady attention without excessive speculation.

The decision caps three weeks of fallout from a wallet exploit that shook Cardano holders. SecondFi is the self-custody wallet formerly known as Yoroi. Crucially, the flaw sat in the wallet software, not in the Cardano blockchain itself.

What the SecondFi Hack Actually Was

First, the important part. The SecondFi hack was not a Cardano protocol failure. It was also not a smart contract or Plutus exploit.

Instead, the root cause was a weak randomness flaw in SecondFi’s own key generation. According to CryptoBriefing, the software used a deterministic nonce during signing. As a result, attackers could rebuild a private key from public on-chain data.

The trigger was simple. Once an affected address signed any transaction, its signature leaked enough math to reconstruct the key. Then the attackers could move the funds at will.

In short, this was classic private key compromise. It came from flawed wallet code, not phishing or device malware. Notably, Cardano’s eUTXO ledger and script rules were never touched.

How Much ADA the Attackers Drained

The confirmed theft is significant. According to SecondFi’s June 24 disclosure, attackers drained about 16 million ADA. That was worth roughly $2.4 million at the time.

Moreover, the drain hit 374 addresses across three distinct events. The attacks landed mostly between June 21 and June 23, 2026. Wave 1 started first, and Wave 2 followed two days later.

The scope may be larger, however. On-chain analysts at Bitquery tracked about 141.9 million ADA in total movement across roughly 3,072 wallets. Attacker addresses also held large NIGHT and SNEK token balances.

Total movement is not the same as total theft, though. Because of that gap, security firm SlowMist put potential user losses above $20 million. Still, that figure remains an estimate pending a full audit.

The 129 Million ADA Question

One number stands out from the rest. Beyond the confirmed theft, roughly 129 million ADA moved during the incident. SecondFi says its team secured those funds through emergency measures.

According to the company, that ADA was routed toward a third-party custodian for affected users. In addition, an external accounting firm was engaged to verify the totals. Bitquery data shows the bulk sitting in a dormant vault since June 23.

Independent confirmation of the custodian transfer is still thin, however. For that reason, the “secured” label deserves caution for now. Meanwhile, the community keeps asking how a self-custody provider moved that much ADA without user signatures.

Recovery odds also split sharply by wave. Wave 1 funds, about 12.3 million ADA, were largely dispersed through Minswap V2. As a result, analysts consider those funds unlikely to return.

Why Restoring Your Seed Phrase Does Not Help

This point matters most for users. Because the flaw lives in the key itself, moving the wallet does not fix it. So restoring a recovery phrase into a new wallet does not remove the risk.

SecondFi was blunt about it. In its disclosure, the team wrote: “The security risk occurs when an affected user signs a transaction. Therefore recovery to another platform or wallet does not mitigate the risk.”

The team added a direct warning in the same thread. “DO NOT restore your recovery phrase into a new Cardano wallet,” it said. Instead, affected users should use the official status checker and follow the migration guidance.

EMURGO has since pushed hardware wallets as the safer path. Notably, a patch already protects newly generated wallets from the flaw.

EMURGO Winds Down SecondFi Operations

The response escalated quickly through early July. On July 6, EMURGO confirmed that SecondFi would not reopen. The Defiant and crypto.news both reported the shutdown of normal operations.

EMURGO framed the choice plainly. “SecondFi will not resume normal operations, even after the audits are complete,” it wrote in its July 6 update. Going forward, its role is limited to a dedicated asset recovery team.

That team has a narrow mandate. Specifically, it must return assets to affected users. In addition, EMURGO is building a wallet status checker, secure migration tools, and an auditable on-chain recovery system.

Each recovery tool still needs an external audit, though. Because of that, EMURGO has not promised firm return dates. So affected users face more waiting before any payout arrives.

Token2049 Handover and What Comes Next

The July 14 handover follows directly from that focus. EMURGO agreed with IntersectMBO and the Cardano Foundation to shift the event. As a result, the Foundation will now deliver Token2049 for the community.

Intersect confirmed the reasoning in its own post. “EMURGO has recently been focused on managing the SecondFi incident,” it said. Consequently, EMURGO could not spare the resources to run the event.

The wider damage still looks contained, thankfully. Cardano DeFi total value locked actually rose during the same window. It climbed from about 523 million ADA on June 19 to 586 million ADA by June 26, per DefiLlama. Because the flaw was isolated to one wallet, the broader network avoided a systemic hit.

The next milestones are clear, at least. Watch for the recovery tools, the audit results, and the first user reimbursements. Until then, affected holders should treat every SecondFi-generated address as unsafe to sign from.