Incident FAQ

  1. What is the scope of the impact?

Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets.


  1. What happened?

An independent investigation
EMURGO engaged Groom Lake, an independent forensic investigation / blockchain intelligence provider to assist with tracing and evidentiary analysis and they reviewed the incident using primary technical evidence, including code, code history, and public blockchain data.


What the investigation indicates to date:

  1. Attack from an external actor: linked to high-volume addresses employing advanced tradecraft: @0xGroomLake indicates that the primary operation behind the unauthorised transfers was sophisticated, external, and well-funded, with indicators consistent with activity by a professional, state-aligned threat actor. Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group.
  2. Two separate attackers: Groom Lake also identified activity by a second party that appears, based on current evidence, to be separate from the primary operation and to have affected a different set of wallets during the same window. No overlap in affected wallets has been identified to date.


The root cause: A cryptographic flaw
The root cause was a highly subtle flaw in how the wallet software generated per-transaction signatures. In simplified terms, a value that should have been derived from secret information could, under certain conditions, be computed from public transaction data. This could enable affected private key material to be derived from information visible on the public blockchain.


This cryptographic flaw was also visible in a copy of the relevant code that had been published without authorisation to a public GitHub repository. We are continuing to assess the circumstances surrounding the publication and are cooperating with the relevant authorities.


The flaw has been patched, and new wallets created with the corrected software are not known to be affected by this issue.


  1. How do I check if my SecondFi / Yoroi wallet is affected and how do I submit a claim?

You can view your balance and check whether your wallet address was potentially affected in the recent incident inside the SecondFi app.


Step 1:


If your wallets are potentially impacted, a warning banner will appear on your Home screen in the SecondFi app. Tap it to view your wallet status.


Please note that statuses are based on preliminary, non-final data from our review of the incident and remain subject to further review.


Step 2:


FOR AFFECTED WALLETS:
Tap the wallet status banner on your home screen (marked with a warning icon).


Here you will see a prompt to submit a claim.


FOR UNAFFECTED WALLETS:
If your wallet is not indicated as affected, there is no action required at this time. We have launched a wallet migration tool that will allow you to transfer transferable Cardano assets that remain in your SecondFi wallet, refer to the Wallet Migration FAQ.


Step 3:


  • Click "Submit claim".
  • Enter your email address
  • Confirm it with the 6-digit verification code
  • Submit your claim



If you can't access the app:
Alternatively, use checker.secondfi.io if you cannot access the app. This is the only official checker, hosted on our secondfi.io domain and shared only through @secondfiapp / @secondfi_jp. It is prepared on a best-efforts basis. It will never ask you to sign a transaction. Any tool that does is a scam.


IMPORTANT: DO NOT USE or remove affected wallets at this time. They may be relevant to any formal process relating to the incident. Wallet status is not a determination of impact, eligibility, entitlement, recovery, or liability.


  1. What's the difference of Migration Tool and Recovery Process?


What Each Does
We are preparing two separate processes: one for migrating supported assets currently held in SecondFi wallets and another for submitting claims concerning assets reported as affected by the June 2026 incident.


  • Wallet migration tool (Launched)

The migration functionality supports transferable Cardano assets that remain in your SecondFi wallet. It allows users to initiate the transfer of eligible ADA, native tokens, and NFTs to a newly created Cardano wallet with a provider of their choice.


Only Cardano assets are supported. Non-Cardano assets must be transferred separately using the applicable network and wallet process.


Because SecondFi is ceasing operations, users should migrate their remaining assets.


The migration tool has undergone an independent security assessment by @Bitdefender. Users should review the published instructions and security information before proceeding.


  • Recovery process (Under development)

The recovery portal lets affected users securely prove ownership of their SecondFi wallet and claim assets impacted by the June 2026 incident via zero-knowledge proofs. Stay tuned for step-by-step instructions. It is currently scheduled to launch in September 2026.


Important Security Reminder:

  • Use only links published through our official channels: @secondfiapp, @secondfi_jp, and support.secondfi.io.
  • Do not rely on links from any other source unless their authenticity has been confirmed through our official website. Launch dates may change if additional security or operational work is required.
  • There are several scam and impersonators. We will continue to remind you of the security risks. It is equally important that users are vigilant and take accountability for using the correct links and following the instructions to avoid scams.


  1. Are all Yoroi-generated wallets compromised?

No. This incident affects a specific set of wallet addresses, not all Yoroi wallets. The vulnerability exists at the address and private key level for affected wallets.



  1. I used Yoroi as a view-only window to a hardware wallet. Am I affected?

No. Hardware wallet users were not compromised by this incident, whether accessed through SecondFi or Yoroi.



  1. Can I transfer assets out of SecondFi?

We have launched a wallet migration tool for this purpose. Refer to the Wallet Migration Guide and Wallet Migration FAQ.


  1. Should I delete my SecondFi app or move it off now?

No. Do not delete the SecondFi app under any circumstances. We strongly advise retaining both the app and your seed phrase, as at least one of these two will be required to claim your assets.



  1. I already deleted the app. What do I do?

If you deleted the app, do not lose your seed phrase. It is now the only way to recover your assets. Recovery needs either the app or the seed phrase, and without one of them, recovery will not be possible.


  1. Will I get my assets back?

Our commitment remains unequivocal: to support the return of assets of all affected wallet holders from the 4 distinct wallet draining events.


  1. I tried to redeem my NIGHT tokens to an affected wallet and they are now lost. Will I get them back?

We are working to help affected users secure the Glacier Drop, but any recovery of NIGHT token redemptions cannot be guaranteed given the nature of the vulnerability. We will share any verified material update through SecondFi's official channels.


  1. What happens to my BRING Cashback rewards?

Due to the nature of the vulnerability, there is currently no safe way for affected users to collect BRING Cashback rewards from a compromised wallet, and we cannot confirm at this time whether these rewards can be recovered.


Please do not take further action with a compromised wallet in an attempt to capture rewards. Continue to follow the official migration and recovery instructions published by SecondFi.


  1. What happens to NFTs that were taken from my wallet?

NFTs are unique, non-fungible assets. Where an NFT was taken from an affected wallet and could not be secured, the original NFT cannot be returned to the affected user.


As a gesture of goodwill, and not as a valuation of the affected NFT, SecondFi intends to grant 30 ADA per eligible NFT confirmed lost and not secured for return.


This is a fixed, standard amount applied uniformly to all eligible NFTs and does not reflect the rarity, market price, or any other measure of an individual NFT's value.


Eligibility will be determined by reference to  SecondFi’s incident snapshot. NFTs minted, acquired, received, or otherwise added to a wallet after this snapshot will not qualify. Only NFTs that SecondFi has confirmed were lost in the incident and have not been secured or recovered for return will be eligible for consideration, in accordance with the applicable recovery terms.


If an NFT associated with an affected address is secured or otherwise turned over to SecondFi for return before a recovery request is submitted, the NFT may be returned through the recovery process to the affected user associated with that wallet.


  1. Will SecondFi compensate for ADA staking rewards I lost?

Rewards that had already been allocated and were transferred during the security incident period to an affected address will be included in the recovery process.


Rewards that had not yet been allocated or paid out at the time of the incident are currently not included in the claim process.



  1. How do I submit a support ticket if I can't open the SecondFi app?

If you can't access the app, submit a support ticket through our web portal at support.secondfi.io, which you can access directly from any browser. As a reminder, do not delete your SecondFi app as it will be required for the claims process.



Important Security Reminder

  1. SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM or email you first. Do not accept links from anyone, including people claiming to be SecondFi team members, support, or partners. If you receive a message like that, it’s a scam.
  2. Scammers have also created fake SecondFi browser extensions and apps. There is no new application or link. Checking your wallet address and balances, migrate your Cardano blockchain assets using the migration tool and submitting a support ticket is all the official app allows right now. If an app offers any other functionality, it is fake. The only official extension is in the Chrome Web Store and carries a blue verified check. If a listing does not have it, do not install it. When in doubt, go directly to secondfi.io/downloads and verify links yourself.


Only trust our official channels:


▪️ X accounts: @secondfiapp and @secondfi_jp
▪️ Support portal: support.secondfi.io
▪️ Wallet status: check in the SecondFi app, or use checker.secondfi.io if you cannot access the app

Updated on: 08/09/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!