Incident FAQ

1. What is the scope of the impact?

Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets.

2. What happened?

An independent investigation
EMURGO engaged Groom Lake, an independent forensic investigation / blockchain intelligence provider to assist with tracing and evidentiary analysis and they reviewed the incident using primary technical evidence, including code, code history, and public blockchain data.

What the investigation indicates to date:

1. Attack from an external actor: linked to high-volume addresses employing advanced tradecraft: @0xGroomLake indicates that the primary operation behind the unauthorised transfers was sophisticated, external, and well-funded, with indicators consistent with activity by a professional, state-aligned threat actor. Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group.
2. Two separate attackers: Groom Lake also identified activity by a second party that appears, based on current evidence, to be separate from the primary operation and to have affected a different set of wallets during the same window. No overlap in affected wallets has been identified to date.

The root cause: A cryptographic flaw
The root cause was a highly subtle flaw in how the wallet software generated per-transaction signatures. In simplified terms, a value that should have been derived from secret information could, under certain conditions, be computed from public transaction data. This could enable affected private key material to be derived from information visible on the public blockchain.

This cryptographic flaw was also visible in a copy of the relevant code that had been published without authorisation to a public GitHub repository. We are continuing to assess the circumstances surrounding the publication and are cooperating with the relevant authorities.

The flaw has been patched, and new wallets created with the corrected software are not known to be affected by this issue.

3. How do I check if my SecondFi / Yoroi wallet is affected and how do I submit a claim?

You can view your balance and check whether your wallet address was potentially affected in the recent incident inside the SecondFi app.

Step 1:

If your wallets are potentially impacted, a warning banner will appear on your Home screen in the SecondFi app. Tap it to view your wallet status.

Please note that statuses are based on preliminary, non-final data from our review of the incident and remain subject to further review.

Step 2:

FOR AFFECTED WALLETS:
Tap the wallet status banner on your home screen (marked with a warning icon)

Here you will see a prompt to submit a claim.

FOR UNAFFECTED WALLETS:
If your wallet is not indicated as affected, there is no action required at this time. We are preparing a wallet migration tool that will allow you to transfer transferable Cardano assets that remain in your SecondFi wallet.

Step 3:

• Click "Submit claim".
• Enter your email address
• Confirm it with the 6-digit verification code
• Submit your claim

If you can't access the app:
Alternatively, use checker.secondfi.io if you cannot access the app. This is the only official checker, hosted on our secondfi.io domain and shared only through @secondfiapp / @secondfi_jp. It is prepared on a best-efforts basis. It will never ask you to sign a transaction. Any tool that does is a scam.

IMPORTANT: DO NOT USE or remove affected wallets at this time. They may be relevant to any formal process relating to the incident. Wallet status is not a determination of impact, eligibility, entitlement, recovery, or liability.

4. What's the difference of Migration Tool and Recovery Process?

What Each Does
We are preparing two separate processes: one for migrating supported assets currently held in SecondFi wallets and another for submitting claims concerning assets reported as affected by the June 2026 incident.

• Wallet migration tool

The migration tool supports transferable Cardano assets that remain in your SecondFi wallet. It allows users to initiate the transfer of eligible ADA, native tokens, and NFTs to a newly created Cardano wallet with a provider of their choice.

The tool supports Cardano assets only. Non-Cardano assets must be transferred separately using the applicable network and wallet process.

Because SecondFi is ceasing operations, users should migrate their remaining assets.

The migration tool has undergone an independent security assessment by @Bitdefender. Users should review the published instructions and security information before proceeding.

• Recovery process

The recovery portal lets affected users securely prove ownership of their SecondFi wallet and claim assets impacted by the June 2026 incident via zero-knowledge proofs. Stay tuned for step-by-step instructions. It is currently scheduled to launch by 10 September 2026.

Important Security Reminder:

• Use only links published through our official channels: @secondfiapp, @secondfi_jp, and support.secondfi.io.
• Do not rely on links from any other source unless their authenticity has been confirmed through our official website. Launch dates may change if additional security or operational work is required.
• There are several scam and impersonators. We will continue to remind you of the security risks. It is equally important that users are vigilant and take accountability for using the correct links and following the instructions to avoid scams.

5. Are all Yoroi-generated wallets compromised?

No. This incident affects a specific set of wallet addresses, not all Yoroi wallets. The vulnerability exists at the address and private key level for affected wallets.

6. I used Yoroi as a view-only window to a hardware wallet. Am I affected?

No. Hardware wallet users were not compromised by this incident, whether accessed through SecondFi or Yoroi.

7. Can I access my wallet in the meantime?

SecondFi is in quarantine mode, meaning you can view your balance and check whether your wallet address was potentially affected in the recent incident inside the SecondFi app. If your wallets are potentially impacted, a warning banner will appear on your Home screen in the SecondFi app. Tap it to view your wallet status. Please note that statuses are based on preliminary, non-final data from our review of the incident and remain subject to further review.

Stop using your existing wallet immediately. Do not send, receive, sign, or stake using your existing SecondFi wallet.

8. Can I transfer assets out of SecondFi?

We will launch a wallet migration tool for this purpose. Every user, whether affected by the incident or not, will need to transfer their assets using this tool. It allows you to move your entire Cardano balance (including all ADA, native tokens, and NFTs) from your current wallet to a newly created Cardano wallet from a provider of your choice.

The tool handles the technical steps automatically. If your ADA is currently staked, the tool will unstake it so the full amount can be included in the transfer. You will need to migrate one wallet at a time. Please do not delete your original wallet from SecondFi or the application itself as it simplifies for the asset recovery process.

Development is provisionally complete and the tool is currently being audited by a third-party cybersecurity firm. We expect the audit to finish shortly and plan to launch the tool during the second week of August.

9. Should I delete my SecondFi app or move it off now?

No. Do not delete the SecondFi app under any circumstances. We strongly advise retaining both the app and your seed phrase, as at least one of these two will be required to claim your assets.

10. I already deleted the app. What do I do?

If you deleted the app, do not lose your seed phrase. It is now the only way to recover your assets. Recovery needs either the app or the seed phrase, and without one of them, recovery will not be possible.

11. Will I get my assets back?

Our commitment remains unequivocal: to support the return of assets of all affected wallet holders from the 4 distinct wallet draining events.

12. What about my staking, DeFi positions, or NIGHT tokens?

Because every protocol works differently, we are working directly with the DEXes and LPs across the ecosystem to help their affected users. We will share more detail as this progresses.

13. How do I submit a support ticket if I can't open the SecondFi app?

If you can't access the app, submit a support ticket through our web portal at support.secondfi.io, which you can access directly from any browser. As a reminder, do not delete your SecondFi app as it will be required for the claims process.

Important Security Reminder

1. SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM or email you first. Do not accept links from anyone, including people claiming to be SecondFi team members, support, or partners. If you receive a message like that, it’s a scam.
2. Scammers have also created fake SecondFi browser extensions and apps. There is no new application or link. Checking your wallet address and balances and submitting a support ticket is all the official app allows right now. If an app offers any other functionality, such as restoring a wallet, it is fake. The only official extension is in the Chrome Web Store and carries a blue verified check. If a listing does not have it, do not install it. When in doubt, go directly to secondfi.io/downloads and verify links yourself.

Only trust our official channels:

▪️ X accounts: @secondfiapp and @secondfi_jp
▪️ Support portal: support.secondfi.io
▪️ Wallet status: check in the SecondFi app, or use checker.secondfi.io if you cannot access the app

Updated on: 14/08/2026