SecondFi exploit analysis

Users of the Cardano wallet SecondFi, formerly known as Yoroi, lost a combined 16 million ADA (about $2.4 million) across three attacks in late June 2026. CoinDesk reported the team's confirmation; Protos followed with the post-mortem. The root cause was a flaw in SecondFi's proprietary wallet generation software that activated at the address level, which meant a user moving their seed phrase to another wallet would still be vulnerable.

Why moving the seed phrase did not help

SecondFi's statement was that "the security risk occurs when an affected user signs a transaction," meaning the vulnerability was triggered at signing time on the compromised address. The team isolated the root cause to the wallet generation software, not to individual seeds or devices, which is why the only remediation was to migrate funds out of any address touched by the buggy code path. The team patched the software for unaffected users and moved 129 million ADA (about $19.4 million) to a third-party custodian before attackers could reach it.

The bigger figure

Blockchain security firm SlowMist estimated total losses could exceed $20 million once the full range of compromised wallets and tokens was accounted for, a figure that remained unconfirmed pending an independent audit. Cardano founder Charles Hoskinson acknowledged the incident while noting the dollar amount was modest relative to other crypto hacks, and stressed that offered little consolation to those affected.

Aftermath

About a month after the exploit SecondFi announced it would shut down operations. EMURGO, the Cardano-aligned entity behind the original Yoroi wallet, confirmed SecondFi would not reopen. Affected users were offered $8 per unrecoverable NFT lost in a later refund snapshot.

Where it sits in the corpus

Wallet-generation bugs are rarer than smart-contract bugs but they share the property that the user cannot mitigate by self-custody alone. The closest analogy in the 2026 corpus is the Coldcard drain, where a flaw in signing code drained more than 2,000 BTC; the broader pattern is that code paths that look local to one device or one project can persist for years and reach every wallet they ever generated.