SecondFi to shut down after $2.6M ADA theft

SecondFi will wind down its SecondFi and Yoroi wallet services after attackers exploited a cryptographic flaw and stole about 16.1 million ADA, roughly $2.6 million, from 374 wallets. The company disclosed the incident in late June and issued an update on Wednesday.

An independent investigation by blockchain intelligence firm Groom Lake identified a sophisticated external actor and reported indicators that may point to the Lazarus Group, a North Korea-linked threat actor. SecondFi has not confirmed attribution.

The company is developing a recovery tool based on zero-knowledge proofs to help affected users retrieve assets while limiting personal information shared. The tool remains in testing and will undergo a third-party audit before a planned release in August. SecondFi is also preparing wallet export functionality to let users move assets to other services once export options are available.

No direct reimbursement plan has been announced, and the company has not said whether it will use its own funds to compensate users. Earlier guidance warned affected users not to import their recovery phrases into new Cardano wallets while the investigation continued.

Users expressed frustration at delays. On June 27, SecondFi indicated it had identified a recovery path and expected to begin the process within about two weeks after security checks. The company now expects the recovery tool to launch in August. One affected user wrote in response to the update: ‘But many of us were told our funds could be recovered within two weeks. Now we’re being asked to wait even longer.’

Requests for comment to SecondFi and EMURGO received no response. The update confirmed the number of affected wallets but did not include a detailed technical breakdown of how the cryptographic flaw was exploited.

Zero-knowledge proofs let users prove ownership of assets without revealing private keys or other sensitive data. Wallet security remains a core concern because software flaws can allow attackers to access or move funds without the owner’s consent.