Security Incident Update

This article will be updated as our investigation progresses. Please check back regularly for the latest information.

⚠️ Important: Wait for Instructions before taking further actions

Independent actions taken outside of official guidance create additional risks, and may significantly complicate the asset claims process. Our team is working through a secure recovery process, and we will continue keeping users updated as progress is made. Official step-by-step instructions will follow shortly.

The only thing you should do right now is submit a ticket at support.secondfi.io.

We will never DM you first or ask for your recovery phrase. If you receive such a message, it is a scam.

Update - 11.40 am SG Time 12th July 2026

SecondFi Is Currently in Quarantine Mode
SecondFi is running in quarantine mode. It's the same application, but transactions are disabled. You can view your balance and wallet address only, you cannot send, swap, or move funds.

A screenshot is below so you know what to expect.

Please protect yourself from scams. Only download SecondFi from our official link: secondfi.io/download

Do not accept download links from anyone else, including emails, messages claiming to be from SecondFi.

Chrome extension is live, app store is pending store approval.

Update - 11 am SG Time 12th July 2026

Security Alert: Fake SecondFi Extensions and Apps

We've seen scammers create fake SecondFi browser extensions and apps. Please read this before you install anything or click any link claiming to be from us. There is no new application or link, it is the same.

Do not accept links from anyone, including people claiming to be SecondFi team members, support, or partners. We will not DM or email you links to download software, sign a transaction, or take any action with your assets. If you receive a message like that, it's a scam. Do not click it.

The only official SecondFi extension is "searchable" in the Chrome Web Store. If you see any other extension using the SecondFi name or branding, it's fake.

Check for the verified blue checkmark. Our official extension listing carries a blue verified check, shown in the screenshots below. If the listing you're looking at doesn't have it, do not install it.

Scammers can and do clone extensions and apps to steal funds. When in doubt, go directly to secondfi.io and verify links yourself rather than trusting anything sent to you.

Please check carefully that you are using the correct application.

Update - 11 am SG Time 10th July 2026

SecondFi / Yoroi Wallet Guidance Sessions in Tokyo and Osaka
We are hosting dedicated in-person guidance sessions for SecondFi and Yoroi Wallet users affected by the security incident.

Each session will include:

• A SecondFi / Yoroi update from our CEO
• A live Q&A with our specialists
• Migration guidance slides

Our team will answer your questions and walk you through best practices for securing your wallet, or safely migrating it using the secure wallet export functionality, which will be released soon.

Please note the guidance slides are informative only. We will not conduct 1:1 or hands-on wallet troubleshooting.

EVENT DETAILS:
Tokyo: Melody Line Hall, 1F, WebX Venue

• (The Prince Park Tower Tokyo, Minato City)
• Tuesday, 14 July 2026, 12:00 to 18:45 JST
• Register here: luma.com/yhgxd9xj

Osaka: TKP Garden City Umeda Osaka

• Saturday, 18 July 2026, 12:00 to 17:45 JST
• Register here: luma.com/6yse3fmg

Sessions are held in English and Japanese. Registration via Luma is required for both, and support is first-come, first-served

Update - 5.30 pm SG Time 8th July 2026

Your Options for Securing Assets, and What’s Next

We recognize that some users may not have completed all steps in the Hardware Wallet Guidance posted in our knowledge base. If you are not technically proficient, we recommend waiting for the secure wallet export functionality, which is currently intended to launch next week.

Here is an update on upcoming options:

• This week: Quarantine mode

We will enable quarantine mode, which will let users check whether a wallet address appears in preliminary incident-related data and submit a support ticket with the relevant wallet address.

• Next week: Secure wallet export functionality

We intend to deploy secure wallet export as the next phase of quarantine mode. This is intended to provide a safer way for users of varying experience levels to move assets to a new wallet.

On potential asset recovery
As stated previously, we intend to support a process relating to potential asset recovery for users whose wallets are confirmed through the applicable process. Any such process remains subject to further investigation, verification, eligibility criteria, applicable terms and conditions, and technical implementation.

It is currently expected to involve a recovery tool using zero-knowledge proofs, initiated by users through a portal, designed to help users remain in control of the process while protecting their information.

Again, if you are not technically proficient, we recommend waiting for these options to go live. For now, you may submit a ticket at support.secondfi.io.

We will continue sharing updates as progress is made.

Update - 6.15 pm SG Time 6th July 2026

Dear Cardano Community,

Significant speculation has surrounded this incident, and we want to be direct: we have engaged multiple independent firms to conduct thorough reviews of both the event and the underlying code. Those investigations are ongoing. Releasing preliminary findings before they are complete risks presenting information that may later prove inaccurate, and we are not willing to do that to our community.

While that work continues, and with a patch submitted that closes the identified vulnerability, our team has been focused on three immediate priorities:

• Asset Safeguarding & Recovery Fund: Establishing protective measures and a dedicated recovery fund for affected users
• Wallet Status Verification: Building mechanisms that allow users to determine whether their wallet was impacted
• Migration Pathways: Providing clear, safe routes to migrate to a hardware wallet solution or alternative platform using quarantine methods.

What This Means for SecondFi Users

Although we believe unaffected users remain safe, SecondFi will not resume normal operations — even after the audits are complete. We ask all users to migrate away from SecondFi using the officially prescribed methods we have published.

We are actively collaborating with leading minds across the Cardano ecosystem to develop an on-chain recovery system that is both auditable and persistent. Meaningful progress is being made daily. However, an external audit of that system is required before we can facilitate the safe return of funds to affected users. We recognise that speed matters — but given the number of known threat actors who are aware of the vulnerability, the safe return of assets must remain the overriding priority.

What Comes Next

This week: We will launch a quarantined site that makes it significantly easier for users to check the status of their wallet and take the necessary steps to migrate. This will be a material improvement over the current wallet-check tool. This has been submitted for app store approval and will be released once that is complete.

Shortly thereafter: We will launch a secure wallet export functionality that will allow users to migrate more easily to a hardware wallet or alternative platform. In addition, there will be an in-person workshop in Tokyo focused on wallet migration.

These steps are a clear and deliberate signal:

SecondFi will not resume normal operations, even once the audits are complete. Going forward, our involvement in SecondFi is limited to a dedicated asset recovery team, tasked solely with returning assets to affected users. This is where our full focus and resources are directed.

On Transparency
We will publish an account of who, what, and why once the incident reports and code reviews are finalised. This is a complex situation, and evidence suggests a number of external threat actors may be involved. We understand the community is seeking answers, and we share that urgency. At this moment, however, our focus is where it must be: safeguarding users, providing unaffected users a clear pathway to a hardware wallet or alternative platform, and returning assets to those who were affected.

Thank you for your patience. @secondfiapp / @secondfi_jp remains the official channel for all updates.

Phillip

Update - 7.30 pm SG Time 4th July 2026

Recovery Fund Address
Our commitment remains unequivocal: to support the return of assets to all affected wallet holders from the 4 distinct wallet draining events. Three of these events were executed by external threat actors resulting in a loss of ~16M ADA.

To return these assets to the victims of the attack, EMURGO has set up a recovery fund address. You can find it here:

addr1qyvvn9e9ulvzw2nvgkwraxwrla4a28l7gmduk7jru2rw9kdxkls8aczwgg8u44nj87uaq50rgcjulcxtzv9q8j0g2lss9kv2ss

Assets secured through our emergency rescue response, including those from the fourth event, are currently protected and accessible. These will form part of the recovery effort to return assets to affected users.

Important Security Reminder
SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first.

Do not trust any checker, link, or account outside our official channels:

• X accounts: @secondfiapp and @secondfi_jp
• Support portal: support.secondfi.io
• Asset recovery wallet checker: checker.secondfi.io

Update - 3 pm SG Time 3rd July 2026

The Asset Recovery Wallet Checker is now live

You can now verify whether your wallet was affected by the incident.
The official checker is live at checker.secondfi.io.

This is the only official checker. It is hosted on our secondfi.io domain and shared only through @secondfiapp and @secondfi_jp.

It will NEVER ask you to sign a transaction.
Any tool that asks you to sign is not ours and should be treated as fraudulent.

This is phase one. In phase two, the checker will show whether your wallet has been affected, alongside an air-gapped transfer option to move assets securely.

Important Security Reminder

SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first.

Do not trust any checker, link, or account outside our official channels:

• X accounts: @secondfiapp and @secondfi_jp
• Support portal: support.secondfi.io
• Asset recovery wallet checker: checker.secondfi.io

Update - 12 pm SG Time 3rd July 2026

Security Alert: Fake Support Emails and Websites
We are seeing fraudulent support emails and fake websites impersonating SecondFi to target affected users. Do not respond, do not click any links, and do not enter your details.

SecondFi does not provide support through Gmail or any personal email account, and our only official domain is secondfi.io. Always check the address carefully and do not trust links shared with you.

SecondFi will never email, DM, or message you first, and we will never ask for your private keys, recovery phrases, or wallet credentials.

Do not trust any checker, link, or account outside our official channels:

• X accounts: @secondfiapp and @secondfi_jp
• Support portal: support.secondfi.io
• Asset recovery wallet checker: checker.secondfi.io

Update - 9 pm SG Time 2nd July 2026

Hardware Wallet Migration Guide

We have published a step-by-step guide to help users securely move their assets to a new hardware wallet, the most secure option for self-custody.

Before you start, keep these in mind:

• If you already use a hardware wallet, no action is required. Hardware wallet users were not affected by this incident.
• Do not delete the SecondFi app, and keep your seed phrase safe. Either one will be required to claim your assets through the recovery process.
• Stop using your existing wallet. Do not send, receive, sign, or stake from it.

The full step-by-step guide, including how to test with a small amount before moving your balance, is available here:
https://kb.secondfi.io/en/article/hardware-wallet-migration-guide-1dnm8is/ 

Important Security Reminder

SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. We will never DM you first.

Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent. Our official channels are @secondfiapp, @secondfi_jp, and support.secondfi.io. 

For support, please submit a ticket only through our official support channel at: support.secondfi.io.

Update — 1:40 pm SG Time 2nd July 2026

SecondFi Security Incident: Recovery Progress Update

Dear Cardano Community,

Our teams continue to work around the clock alongside some of the smartest technical minds in the Cardano ecosystem to work on an onchain recovery process. Thanks to these efforts, tremendous progress has been made and a viable solution remains on-track. We are grateful for their support.

Alongside this, we are developing an onchain claims portal to facilitate the return of assets.

DO NOT delete the App and keep your seed phrase safe to more efficiently enable recovery. For now, submit a ticket at support.secondfi.io

Further Progress

Today, we released the official Asset Recovery Wallet Checker at checker.secondfi.io, so you may verify whether you are impacted. It will never ask you to sign a transaction. If any tool does, it is not ours and should be treated as fraudulent.

Our commitment remains unequivocal: to support the return of assets to all affected wallet holders across 4 distinct wallet draining events.
Three of these events were executed by external threat actors, resulting in a loss of ~16M ADA. EMURGO has set up a recovery fund address to return assets to the victims of the attack.

You can find the address here:
addr1qyvvn9e9ulvzw2nvgkwraxwrla4a28l7gmduk7jru2rw9kdxkls8aczwgg8u44nj87uaq50rgcjulcxtzv9q8j0g2lss9kv2ss

Notably, assets recovered by white hats (including the 4th event) are accessible and safely held. These will be part of the recovery effort to return assets to affected users.

Commitment to Transparency

Independent auditors are currently reviewing our systems and validating our findings. We intend to share those reports once finalised. Premature releases may result in misinformation or tip off threat actors. We appreciate your patience.

WebX Tokyo

As a commitment to our user base, our team will be at WebX in Tokyo, to answer questions on how to migrate to other wallet platforms using hardware devices. Details to follow ahead of the event for those who wish to seek out this guidance and support.

Important Security Reminder

SecondFi will NEVER request private keys, seed phrases, wallet credentials, or wallet access. No recovery actions requiring user participation have begun. Any message instructing you to transfer assets or share wallet information outside our official channels should be treated as fraudulent. The only action required right now is to submit a ticket at support.secondfi.io.

Our Commitment

Trust at moments like this is built through action, not assurance. Every decision we're making has one objective: returning assets safely to every affected user, as soon as possible.

Thank you for your patience during this difficult time. @secondfiapp / @secondfi_jp remains the official channel for all updates.

Phillip

Update — 10:45 am SG Time 2nd July 2026

Recovery Process Update

Your assets remain safe. Our team's full focus is on recovery. Here is where things stand today:

How do I check if my wallet is affected?
The asset recovery wallet checker is now live: checker.secondfi.io

This is the only official checker, hosted on our secondfi.io domain and shared only through @secondfiapp / @secondfi_jp. It is prepared on a best-efforts basis. It will never ask you to sign a transaction. Any tool that does is a scam.

This is phase one. In phase two, the checker will show whether your wallet has been affected, alongside an air-gapped transfer option to move assets securely.

I am not affected, what are my options?
If you wish to migrate, we recommend moving your assets to a newly created wallet using a hardware wallet only. We will release clear, step-by-step migration instructions to guide you through this.

I am affected, what do I do?
We are working on an onchain recovery tool. For now, submit a ticket at support.secondfi.io and keep your app and seed phrase safe. Recovery instructions will only be released once the Intersect Security Council has completed its review.

How do I recover my assets?
Our teams are working with the smartest minds in Cardano, who have dropped everything to work on this incident, to develop an onchain claims portal. Which is now in preview mode and will be released soon.

Understanding what happened
Several auditors and independent experts are analysing onchain activity and validating our findings. Reports are coming, and we intend to share relevant reports once finalised. We cannot share findings before then, as doing so may cause further issues.

How do I make a claim?
If you want to make a claim, submit your ticket at support.secondfi.io.

Please remember:

DO

• Keep the SecondFi app installed
• Keep your seed phrase safe
• Use only checker.secondfi.io to check your wallet
• Submit a ticket at support.secondfi.io

DON'T

• Delete the SecondFi app
• Share private keys, recovery phrases, or wallet credentials with anyone
• Trust any checker, link, or account outside our official channels
• Act on messages telling you to move assets or submit wallet information

SecondFi will NEVER request private keys, recovery phrases, or wallet credentials. No recovery actions requiring user participation have begun. @secondfiapp / @secondfi_jp remains the official channel for all updates.

Update — 2.15pm SGT 30th June 2026

IMPORTANT SECURITY REMINDER

These are the ONLY OFFICIAL SecondFi channels:
X accounts @secondfiapp and @secondfi_jp

Support portal: support.secondfi.io

We will never DM you first or ask for your recovery phrase.

Any other account is a scam account.

If you come across a fake account or suspicious message, please report it to X. The screenshots below show known impersonator accounts to watch out for.

Stay alert, and only trust updates from our official channels.

Update — 7.45pm SGT 29th June 2026

Recovery Process Update

Today, we want to share an update across three areas:

1. Returning user assets
2. Moving user assets safely
3. Onchain recovery

1. Returning User Assets

• Drained by the attackers: EMURGO has funded an Asset Recovery Wallet specifically to return assets to users whose wallets were compromised in the attack.
• Secured through our emergency rescue response: These assets are currently protected and accessible. We are in discussion with IntersectMBO on the appropriate custody mechanism to ensure they are held securely and returned to users.

2. Moving Your Assets
Our initial guidance was to stay put which was a deliberate step while we worked to fully understand the attack vector and avoid exposing users to further risk. Following active discussions with the Intersect Security Council, should you decide to move your assets, we recommend creating a new wallet using a hardware wallet only. A hardware wallet is the most secure option available.

Important: However, users should NOT delete the SecondFi app under any circumstances. We strongly advise users to retain BOTH the app and their seed phrase, as they will be required to support the asset recovery process currently underway.

3. Onchain Recovery
Our team is actively progressing an on-chain recovery solution designed to support the secure return of user assets. Extensive technical assessment has identified this as the most secure and efficient recovery pathway currently available.

We are now working closely with a Cardano community-led task force to develop, validate and execute this solution securely.

This process is more complex than originally anticipated and may require additional time beyond our previously estimated 2-week timeline.

We will continue providing updates as progress continues.

Important Security Reminder:
SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances. We will never DM you first.

Any message instructing you to move assets or submit wallet information outside of our verified official channels should be treated as fraudulent. Our official channels are our verified SecondFi X account and support.secondfi.io.

For support, please submit a ticket only through our official support channel at support.secondfi.io.

Thank you for your continued trust as this work continues.

Update — 8am SGT 28th June 2026

⚠️ Important Security Update

We are seeing an increase in malicious activity and impersonation attempts related to the recent incident.

As a precaution, please DO NOT deposit any additional funds into your existing SecondFi wallet until further notice.

To help users safely navigate next steps, we will be releasing:

1. A suitable mechanism to allow users to check whether their wallet has been affected by early next week.
2. A secure process that will allow users to safely move assets out of the platform thereafter.

Please remember that NO recovery actions require user participation have begun at this stage. Wallets should remain untouched until official recovery instructions are provided.

SecondFi will NEVER request private keys, seed phrases, wallet credentials, or request asset transfers under any circumstances.

For support, please submit a ticket only through our official support channel at support.secondfi.io.

Thank you to everyone for your continued patience and trust as this work continues.

Update — 12.15pm SGT 27th June 2026

SecondFi Security Incident: Executing Recovery 
Over the past several days, our engineering and security teams have remained fully mobilized, operating continuously around the clock to secure the platform, complete forensic investigations, validate wallet balances, and establish the safest possible recovery pathway for affected users.

We confirm that this work has now led to a meaningful breakthrough. We have successfully identified a clear recovery solution, marking an important step forward in our efforts to return assets to users safely and securely.

What Happens Next
Our immediate focus now turns to execution. We are working toward an estimated two-week timeline: the coming week will be dedicated to building the solution itself, followed by a second week of testing and review before assets can begin being safely returned to users.

While we are moving with urgency, it is important to recognize that this process cannot be rushed.

For this reason, we want to reiterate and recommend once again: users should not independently migrate assets or take action outside of official SecondFi guidance. The recovery process currently underway is being designed around existing wallet states, and independent action at this stage may significantly complicate the secure return of assets.

Important Security Advisory
We understand that some users may feel compelled to move assets as a precautionary measure. However, should you choose to do so independently, you do so entirely at your own risk.

We also want to make the community aware that malicious actors are now attempting to exploit the current situation by circulating fraudulent communications impersonating SecondFi.

As a reminder, SecondFi will NEVER request private keys, seed phrases, wallet credentials, or direct wallet access under any circumstances. No recovery actions requiring user participation have begun at this stage. Any communication instructing users to transfer assets, submit wallet information, or take action outside of our verified official channels should be treated as fraudulent.

The only thing you should do, if you have yet to, is to submit a ticket at support.secondfi.io.

Our Commitment
We recognise that confidence and trust at moments like this is built not through assurances alone, but through disciplined execution. This is precisely what guides us now. Every action being taken right now is focused on returning assets safely and  protecting users.

I want to thank the broader Cardano community, our ecosystem partners, and users who have continued standing with us throughout this process. The support, coordination, and resilience shown across the ecosystem over the past week has only strengthened our resolve to see this through responsibly and successfully.

Again, x.com/secondfiapp remains the official channel for communications and we will continue to provide proactive updates every step of the way.

Thank you.

Phillip

Update — 11.15am SGT 27th June 2026

⚠️ Important Security Advisory: Scam Attempts

We have identified fraudulent messages circulating online from malicious actors attempting to impersonate SecondFi while our incident response remains underway.

Please note that NO recovery actions requiring user participation have begun at this time.

SecondFi will NEVER request private keys, seed phrases, wallet credentials, or direct wallet access under any circumstances.

Any communication instructing users to submit wallet information, migrate assets, or take immediate action outside of our verified official SecondFi channels should be considered fraudulent. NO user action is required at this stage.

You may submit a ticket through our official support channel at support.secondfi.io.

Our team is actively monitoring these malicious activities alongside our ongoing recovery progress, and we will continue sharing verified updates as progress continues.

Update — 7.45pm SGT 26th June 2026

Recovery Process Update

Our team remains focused on returning assets to affected users, and we are making strong progress on a structured recovery and verification process.

Two important updates today:

1. The final balance snapshot has been taken today, Friday 26 June 2026. We have been capturing regular snapshots throughout the incident response, and this final one gives us an accurate, verified record of balances to work from as we prepare recovery.

2. Timing of recovery. Behind the scenes, our engineering and security teams have worked around the clock to validate balances and evaluate recovery mechanisms. This has led to a solution where assets can begin being returned, which we estimate is around two weeks away: roughly one week to reach a working solution, then a week of testing and review. Timing may shift as the work continues but our priority is clear: a safe return of funds and getting SecondFi back online responsibly.

We will resume operations once we are fully confident the platform is secure and all security reviews are complete and we are determined to get there as quickly as we safely can.

For now, the only action required is to submit a support ticket at support.secondfi.io. 

We appreciate your continued patience as we work through this process responsibly and will continue sharing updates as progress is made.

Update — 4.30pm SGT 26th June 2026

Important Guidance for SecondFi Users

We understand that many users are considering migrating to new wallets, and that trusted members of the Cardano community are suggesting ways to do so. We recognise this comes from a desire to protect your assets. If you choose to migrate, you do so at your own risk.

However, we strongly advise against taking this action at this time. Particularly if you are not technical, the safest course is to leave it untouched.

Independent actions taken outside of official guidance create additional risks, and may significantly complicate the asset claims process. Our team is working through a secure recovery process, and we will continue keeping users updated as progress is made. Official step by step instructions will follow shortly.

If you have a query, you may submit a ticket at support.secondfi.io. We will never DM you first or ask for your recovery phrase.

Thank you for your patience.

Update — 10am SGT 26th June 2026

As stated, we have identified the root cause, it is at the address level. Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.

In addition, we are working to facilitate the verification process so users can claim back their assets safely, following the above is very important, as it makes claims more difficult.

There has been conflicting advice from different community members in an attempt to be helpful. Do nothing until official steps come from SecondFi.

The only thing you should do is submit a ticket at support.secondfi.io.

We will never DM you first or ask for your recovery phrase.

Update — 6.35pm SGT 25th June 2026

We aim to provide the latest update on our investigation into the exploit

As mentioned in our previous post, between June 21–23, 2026, a sophisticated, automated attack drained funds from multiple Cardano wallets. We now have identified and isolated the addresses of 2 attackers.

We are sharing them below with the community, for full transparency.

Attacker A (Waves 1 & 2)
Drained 171 wallets across two automated batches.

• Collection Wallet 1: addr1q9j7f598x988unr4zhjulft205jqnn9ewgwkhes5smf2sr6jsw98nm4qq38jw9epe587twavuhuhj5d8r92rjvmyjlzs9lqc3x
• Collection Wallet 2: addr1q9wudkfeelzwev427yvapkmqexmet8q4vl303m7a4eerwtvt6rq00zyuqzeuw759vgqtdky0gyxnqx27n8q4k6h79yhsqelma8
• Collection Wallet 3: addr1q82jlp2u0ezv2hsf6f40fkrv49hd72yv442nmrr5qeultpqamepaykp3m564hnd4zp75wxxds2j6d3ywvc8prhf2kcxqn6nql3
• Central Fee/Change Address: addr1q8acx4h5a38x6ekpsp0x7aelw6mflt78khmz8lz75rtnqvn07w88zx2e89tgzqr3x0mecngqlg87kq9surhk48hj79mqcezfa8
• Attacker Stake Key: Stake1u9hl8rn3r9vnj45pqpcn8auuf5q05rltqzcwpmm2nme0zasf40ymg

Attacker B (Wave 3)
Drained 203 wallets in a separate automated sweep.

• Collection Wallet (⚠️ 4,020,468 ADA linked to the exploit remains in this address, which has been flagged and is under active monitoring and investigation): addr1q8m5wdncq7rwum73r5cyyr82qx2xjem5k4ehapl3wy36aaerj829vasl3amtcwshgvnn6a25dr850tfw6qaj420d2szsslkku6
• Attacker Stake Key: Stake1uy3er4zkwc0c7a4u8gt5xfeaw42x3n6845hdqwe248k4gpgdq4da5

Update — 3.15pm SGT 25th June 2026

Message from Phillip Pon, CEO of EMURGO

Dear Cardano Community,

Over the past 72 hours, SecondFi – Cardano's largest wallet provider – was the target of a highly sophisticated, pre-meditated, and deliberate security incident.

Initial forensic evidence points to a coordinated, multi-actor exploit enterprise. While an advanced threat of this nature could target any participant within our ecosystem, we recognize that as a co-founding entity of Cardano, our responsibility in moments like this is held to a higher standard of accountability and action.

We remain fully committed to returning the assets of all affected wallet holders from the 4 distinct wallet draining events. Active rescue efforts are ongoing.

Here is where we stand:

Discovery, Patching, and Impact
Following the initial discovery on June 22nd, emergency response protocols were immediately activated to investigate the issue and protect user assets. Our engineering teams successfully isolated the exploit vector, deployed immediate remediation measures, and moved SecondFi into maintenance mode to prevent any further contagion while investigations continue.

We have since engaged a leading security firm, alongside additional independent security partners, to conduct a full review of the attack vector and ensure the integrity of our systems before normal operations resume.

Impact Assessment
Our investigation has confirmed that 374 wallet addresses were affected across three separate attack events, resulting in approximately 16 million ADA being compromised. This represented losses of approximately US$2.4 million.

In parallel, emergency rescue measures were immediately initiated and remain ongoing. Through these efforts, we have already successfully secured approximately 129 million ADA as part of our broader containment and asset protection response.

All recovered assets are currently being held securely while recovery efforts continue.

Recovery 
We have now completed the identification and mapping of wallet addresses impacted during the initial exploit, allowing us to begin the next phase of recovery with confidence and precision.

Our commitment remains unequivocal: to support the return of assets of all affected wallet addresses from the 4 distinct wallet draining events.

To support this process, a dedicated and independently secured restoration fund has already been established, forming the foundation of a transparent reimbursement process for affected users.

As part of recovery, we are working to facilitate the verification process so users can claim back their assets safely. While this process will require additional verification steps and may take longer, it is the most secure and responsible path to ensuring assets are returned safely and accurately.

We will continue updating affected users regularly as recovery efforts progress and as each stage of the claim process is completed.

Return to Operations
SecondFi will only resume normal operations once additional security reviews and independent audits have been completed. We have engaged external security firms to conduct a comprehensive review of the protocol at the code level, and we will not restore platform access until we are fully confident in the integrity and security of our systems.

Wallets impacted during this incident will remain subject to controlled recovery procedures, and affected users will receive clear guidance on the steps required to safely restore access and recover assets through our official recovery process.

In parallel, we will be submitting formal incident reports to the relevant authorities and pursuing every available legal avenue to recover lost assets and hold responsible parties accountable.

Critical Security Notice
Based on our investigation, wallets compromised during this incident should be treated as permanently compromised. The vulnerability exists at the address and private key level, which means simply importing or restoring an affected recovery phrase into another wallet provider will not resolve the security risk.

For this reason, affected users must not independently move assets, restore seed phrases, or attempt to migrate compromised wallets to another Cardano wallet application. Taking independent action may expose users to further compromise.

We will shortly provide a clear recovery process outlining how affected users can safely migrate and restore access through our official recovery procedures.

Ecosystem Solidarity
Moments like these serve as an important reminder that the long-term strength of any ecosystem is ultimately defined not only by its technology, but by the collective commitment of its community to protect and support one another when it matters most.

We want to recognize and thank the founding entities, partners, and community members who mobilized immediately to support our response efforts and help contain broader risk to the network.

Through real-time collaboration, intelligence sharing, and coordinated action, the wider ecosystem worked swiftly alongside us to strengthen our response and safeguard the broader stability of Cardano during a critical period. This incident has reflected the strength and resilience of the Cardano ecosystem at its best.
@secondfiapp remains the official channel for communications, and we will continue to provide proactive updates every step of the way.

Thank you.

Phillip

Update — 2.45pm SGT 25th June 2026

Technical Explanation of the Vulnerability

We have identified the root cause of the attack. It is at the address level.

The affected software signer used a deterministic nonce derivation flaw. Every time an address signed a transaction, it leaked enough information to mathematically reconstruct that address's private key from public blockchain data alone.

If you were affected by the hack, your first/default address (index 0) is almost certainly exposed. It is the address that some wallets may be using by default or as the only address at all, and nearly always has transactions. That history is all an attacker needs.

Please DO NOT RESTORE your recovery phrase into another Cardano wallet. This does not mitigate the security risk. 

Your keys are derived from your recovery phrase, not from the app. Restoring the same phrase into another wallet recreates identical addresses with identical exposure. The compromised thing is the key of the compromised address(es), not the interface you are using.

If you were affected by the hack, and use any of your compromised address(es) for deposit it might be drained again. This includes withdrawing staking rewards even using another wallet.

Reward withdrawal and delegation are signed with the stake credential. The withdrawn funds could be routed to your first/default address (as indicated above), which has a high chance of being compromised (wallets work differently managing it). Mempool-monitoring adversaries can front-run or sweep your assets on confirmation.

There has been conflicting advice from community members in an attempt to be helpful. Do nothing until official steps come from SecondFi.

We are working to facilitate the verification process so users can claim back their assets safely. Following the above is very important, as it makes claims more difficult.

The only thing you should do right now is submit a ticket at support.secondfi.io.

We will never DM you first or ask for your recovery phrase.

Update — 8.30pm SGT 24th June 2026

We have identified the root cause and have since rolled out a patch for all unaffected wallets. This will allow us to resume normal operations soon.

Regarding affected wallets, 4 distinct draining events occurred. 3 were executed by external threat actors, resulting in a loss of ~16m ADA across 374 addresses.

To prevent total loss during the active exploit, emergency rescue measures were triggered to secure the available ~129m ADA and continues to be routed to an independent, qualified third-party custodian, where they are held securely for the benefit of the affected wallet addresses.

An external accounting firm has been engaged for a special audit to independently verify those holdings.

We are working to facilitate the verification process so users can claim back their assets safely. Affected users should submit their claim at support.secondfi.io.

We take this incident seriously and are working to ensure all assets are returned to affected users as soon as possible.

As stated, we have identified the root cause, it is at the address level. Please DO NOT RESTORE your recovery phrase into another Cardano wallet, this does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.

What happened?

We identified a security issue affecting a small number of Cardano wallets on our platform. The issue was confined to our native Cardano web wallet generation software. We have contained the issue and paused the affected functions while our engineering team works to restore full functionality.

What should I do right now?

At this time, no action is required from you other than submitting a claim at support.secondfi.io if your wallet was affected. Please keep the following in mind:

• Do not restore your recovery phrase into a new Cardano wallet. This does not mitigate the security risk. The security risk occurs when an affected user signs a transaction.
• Do not share your recovery phrase with anyone. SecondFi team members will never ask for it.
• Ignore unsolicited messages. We are seeing a surge in scammers and impersonators taking advantage of this situation. SecondFi will never DM you first.
• Use official channels only. All official support is handled through logged tickets at support.secondfi.io.

How do I know if a message is really from SecondFi?

SecondFi team members will never:

• Send you a direct message first on any platform
• Ask for your seed phrase or recovery phrase
• Ask you to transfer funds to any address

All official communications come through our verified accounts and support portal at secondfi.io.

Where can I get the latest updates?

• This page — updated as new information becomes available
• Official X: x.com/secondfiapp ; x.com/secondfi_jp
• Support portal: secondfi.io

Our team is working around the clock and we are committed to keeping our community informed throughout this process. Thank you for your patience.

Updated on: 13/07/2026