- SecondFi confirmed three external attacks drained 16 million ADA ($2.4 million) from 374 wallets via a flaw in its proprietary wallet generation software; a patch has been rolled out for unaffected users.
- The team rescued a further 129 million ADA before attackers could reach it, routing funds to a third-party custodian — but blockchain security firm SlowMist estimates total losses could still exceed $20 million pending an independent audit.
- Users cannot protect themselves by moving their seed phrase to another wallet; the vulnerability activates at the address level when a transaction is signed, and affected users must submit claims directly to SecondFi.
SecondFi, the Cardano wallet formerly known as Yoroi, says it has patched a major exploit that drained roughly 16 million ADA, worth approximately $2.4 million, from 374 user wallets across three separate attacks.
The root cause was a flaw in SecondFi's proprietary wallet generation software. The vulnerability sits at the address level, meaning simply moving a seed phrase to another wallet offers no protection. "The security risk occurs when an affected user signs a transaction," the team said on X.
Before attackers could reach a further 129 million ADA, SecondFi said it triggered emergency rescue measures, routing the funds to an independent third-party custodian. An external accounting firm has been engaged to verify those holdings and affected users can submit claims to SecondFi.
Blockchain security firm SlowMist estimates total losses could exceed $20 million when accounting for the full range of compromised wallets and tokens, a figure that remains unconfirmed pending an independent audit.
Cardano founder Charles Hoskinson acknowledged the incident but noted the dollar amount was modest relative to other crypto hacks, though he stressed that offered little consolation to those affected. "It hurts them whenever they lose anything," he said. "This is the unfortunate reality of crypto."
ADA is currently trading around $0.15, its lowest level since 2020.
