SecondFi Wallet Exploit—16 Million ADA Vulnerable
By John Nada·Jun 24, 2026·5 min read
SecondFi wallet's address-level issue exploited—16 million ADA affected. Cardano distanced from breach, with funds secured pending verification.
"SecondFi’s wallet software exposed the private keys it generated," said Mitchell Amador, CEO of security company Immunefi, according to Cointelegraph. This statement uncovers the root vulnerability that left the Cardano-based wallet compromised, allowing attackers to siphon off user funds and causing substantial financial losses.
SecondFi, a self-custodial platform recently rebranded from the Yoroi wallet in April 2026, confirmed this breach on Wednesday. The company is actively working with Cardano ecosystem platforms and blockchain investigators to patch the issue. An emergency measure was triggered to secure around 129 million ADA, transferring the funds to an independent third-party custodian to safeguard affected users.
Cardano founder Charles Hoskinson distanced Input Output Global (IOG) from the breach, emphasizing that SecondFi is not a product of IOG and no direct business relationship exists. In a video posted on X, Hoskinson pointed out that while IOG's incident response team has been in talks with SecondFi, they didn’t write the code linked to the exploit.
The incident, rooted in an address-level issue, attacked the Cardano web wallet generation software, leading to an estimated vulnerability affecting 16 million ADA, approximately $2.4 million, across 374 addresses. Details were scant on the exact specifics as SecondFi had not yet released a full post-mortem at the time of publication.
Immunefi's Amador highlighted a worrying trend in cyberattacks targeting key-generating infrastructure within the crypto space. “The code that generates the keys is the part nobody audits like a contract,” he noted. This signifies a shift in attack strategies towards the infrastructure that generates or stores crypto keys rather than the blockchain protocols themselves.
SecondFi’s guidance recommended users avoid restoring recovery phrases into new Cardano wallets, a piece of advice that diverged from some community members' recommendations to migrate funds to new addresses. This cautious stance underscores the nuanced nature of responding to security threats in rapidly evolving blockchain ecosystems.
Despite the crisis, SecondFi's preemptive initiatives to work with blockchain investigators and implement custodial solutions indicate a proactive approach to damage control. While ADA holders wait for further updates, the incident serves as a crucial reminder of the ongoing challenges in securing blockchain technology and wallet infrastructures.
Hoskinson's assertion that “We didn’t write the code and we’re not connected to it,” underlines a need for clearer lines of accountability in an ecosystem as interconnected as Cardano. Still, it's notable how quickly stakeholders mobilized to mitigate the impact, reflecting a maturing approach to crisis management in the crypto industry.
The breach is especially concerning given the history of the Yoroi wallet, which was developed by Emurgo as the first open-source light wallet for the Cardano blockchain. Emurgo, described as the "for-profit arm of Cardano," played a significant role in the Cardano ecosystem, yet the separation between Emurgo and IOG is clear. Hoskinson emphasized that IOG “is not Emurgo,” thereby clarifying the distinct roles and responsibilities within the ecosystem.
SecondFi's ability to secure a large amount of ADA post-breach is significant. The move to place approximately 129 million ADA under the custody of an independent third-party custodian was a decisive step to protect user assets. This action reflects a growing trend in the crypto industry where third-party custodians are increasingly relied upon during crises to provide a layer of security and trust.
The ongoing investigation into the breach highlights the complexities involved in securing self-custodial platforms. As the crypto industry matures, the focus is shifting from solely securing blockchain protocols to fortifying the infrastructures that support these protocols. This evolution in security strategy underscores the importance of regular audits and robust security practices for all components involved in cryptocurrency storage and transactions.
SecondFi's case also sheds light on the broader issue of key management within the crypto space. As Immunefi's Amador pointed out, the code responsible for generating keys often lacks the rigorous audits applied to smart contracts. This gap in security oversight presents a significant vulnerability, as attackers increasingly target the foundational infrastructure of cryptocurrency ecosystems.
The response from the Cardano community has been one of caution and prudence. While some community members suggested migrating funds to new addresses, SecondFi advised against this, emphasizing the potential risks involved. This divergence in opinions highlights the challenges faced by users and developers in navigating security threats effectively.
As the situation unfolds, the crypto community is reminded of the importance of transparency and communication in crisis response. The swift mobilization of stakeholders, from Cardano's IOG to blockchain investigators and third-party custodians, illustrates the collaborative efforts required to safeguard user assets and restore trust.
Ultimately, the SecondFi wallet exploit serves as a stark reminder of the vulnerabilities inherent in the rapidly evolving crypto landscape. It underscores the need for continuous improvement in security measures, increased collaboration among stakeholders, and a proactive approach to identifying and mitigating potential risks. As the investigation continues, the lessons learned from this incident will undoubtedly inform future security practices and reinforce the resilience of the Cardano ecosystem.