SecondFi Cardano Wallet Exploit and Address-Level Flaw

The incident concerned a compromise affecting SecondFi’s Cardano wallet software, which the company said was rooted in an address-level flaw rather than a generalized network failure on Cardano itself.^[1][6] Public reporting attributed to SecondFi stated that attackers drained funds from 374 addresses and that the platform estimated around 16 million ADA, or $2.4 million, was affected.^[2][4] In the same reporting, the company described the problem as one arising within its own wallet generation and signing flow, placing the operative failure inside wallet software rather than in the underlying chain.^[1][6]

The earliest pivotal public disclosure in the present record was SecondFi’s estimate, dated 2026-06-23 in the timeline, that around 16 million ADA, or $2.4 million, had been affected across 374 addresses.^[4] That estimate established the initial scale of the event in both token and dollar terms and tied the losses to a defined set of addresses rather than to a broad protocol-wide malfunction.^[2][4] At that stage, the available record did not include transaction hashes, a named attacker, or a technical write-up sufficient to independently reconstruct the exploit path, but it did establish that the platform itself was treating the event as a wallet compromise with user balances already drained from identified addresses.^[2][4]

SecondFi’s subsequent explanation, dated 2026-06-24 in the timeline, was that the incident had been traced to an address-level issue in its Cardano wallet software.^[1] The company further stated that its wallet software exposed the private keys it generated.^[5] In practical terms, that description placed the principal mechanism in the category of private key compromise: if keys generated by the wallet became exposed, an attacker with access to those keys could authorize transfers from affected addresses without needing to compromise the Cardano network itself.^[5] The public account did not specify whether the exposure arose during key generation, storage, derivation, display, logging, or another implementation detail, but the company’s own wording directly connected the exploit to exposed private keys produced by the wallet software.^[5]

SecondFi also stated that the root cause was an issue at the address level that affects users when they sign transactions.^[6] That statement narrowed the operational trigger further: according to the company, the vulnerability manifested in connection with transaction signing rather than only at wallet creation or passive storage.^[6] The available record therefore suggests a sequence in which users interacted with the wallet’s signing process, the software’s address-level defect exposed or otherwise compromised the relevant private keys, and attackers then used that access to drain funds from the affected addresses.^[2][5][6] Because no completed technical post-mortem has been included in the dossier, that sequence remains dependent on SecondFi’s own description rather than on independently published forensic evidence.^[1][5][6]

After identifying the issue, SecondFi said it triggered emergency measures that secured roughly 129 million ADA for affected users pending verification.^[3] This was materially larger than the platform’s estimate of around 16 million ADA affected by the exploit itself, indicating that the emergency response was framed as a protective custody action extending beyond the balances already reported as drained.^[3][4] The record did not establish the exact operational form of that custody, the criteria used to determine which users were included, or the chain-level addresses into which the funds were moved.^[3] It did, however, show that SecondFi represented the intervention as a containment measure undertaken while user verification remained pending.^[3]

The same timeline also recorded a user-facing warning from SecondFi not to restore recovery phrases into new Cardano wallets.^[6] Although the dossier did not provide the full text of that warning beyond the timeline summary, its inclusion is consistent with the company’s statement that generated private keys had been exposed.^[5][6] If a seed phrase or derived key material had already been compromised, migrating it into a new wallet interface would not by itself remediate the underlying exposure. The warning therefore functioned as a containment measure within the company’s stated theory of the incident, even though the present record did not include a full remediation protocol, a patch note, or a formal incident report describing how unaffected users were to proceed.^[5][6]

The documented consequences were limited but material. SecondFi estimated that around 16 million ADA, or $2.4 million, was affected across 374 addresses, and it stated that emergency measures secured roughly 129 million ADA pending verification for affected users.^[2][3][4] The incident also prompted public distancing by Cardano founder Charles Hoskinson, who was described in the dossier as stating that Input Output Global was not connected to the wallet and had no ownership, control, or business relationship with it; however, the present brief did not include that statement as a separately citable body claim and therefore it remains contextual rather than central to the incident mechanism. As of 2026-06-24, the available record documented the platform’s stated cause, the reported number of affected addresses, the estimated amount affected, and the emergency custody action, but it did not establish final recovery, legal proceedings, or attacker attribution.^{[1][2][3][4][5][6]}