SecondFi keeps two-week recovery plan after $2.4M Cardano wallet exploit

SecondFi says it remains on track to recover user assets after a Cardano wallet exploit drained about $2.4 million in ADA. 

The latest update comes as users wait for a wallet check tool and clear steps to move assets safely.

SecondFi says recovery work remains on track

SecondFi said its recovery process is still moving within the estimated two-week timeline. The team said engineers are working on several technical routes at the same time to choose the safest recovery method for affected users.

The project said it plans to release a tool by early next week that will let users check whether their wallet was affected. It also said it will later share a secure process that lets users move assets out of the platform.

SecondFi warned that no recovery step needing user action has started. It told users to leave wallets untouched until official instructions arrive and said it will never ask for private keys, seed phrases, wallet credentials or asset transfers.

The latest notice followed another warning about rising scam activity. SecondFi said fake accounts and impersonators have been targeting users after the exploit. It also told users not to deposit more funds into existing SecondFi wallets until further notice.

Exploit drained 16 million ADA from 374 addresses

The case began after attackers drained about 16 million ADA from 374 addresses between June 21 and June 23. The value stood near $2.4 million at the time of the reported theft.

SecondFi has linked the issue to its own Cardano wallet generation software. As crypto.news reported, the project said the problem was limited to its native Cardano web wallet generation software and that affected services had been paused.

EMURGO CEO Phillip Pon later said the company had completed a forensic review, checked wallet balances and found what he called a “clear recovery solution.” The company expects one week to build the recovery system and another week to test it before returns begin.

SecondFi also moved about 129 million ADA to an independent third-party custodian as an emergency measure. The company said it took that step to keep more assets away from attackers while it reviewed the breach.

Outside report questions wallet code

A report from Tibane Labs gave a more detailed account of the possible technical fault. The firm said the breach came from an unaudited third-party SDK that replaced EMURGO’s audited signing code on June 8.

Security researcher Taylor Monahan also criticized the wallet code, saying SecondFi “rolled their own crypto.” The comment added pressure on the project because Yoroi, now SecondFi, had served Cardano users for years before the rebrand.

The full cause still needs an official technical report from EMURGO or SecondFi. Until then, users only have public updates, outside analysis and the project’s recovery notices to follow.

Users wait for wallet checker and safe exit steps

SecondFi’s next key step is the wallet check mechanism expected by early next week. That tool should help users know whether they are part of the affected group before any recovery action begins.

The project has asked users to use only official channels and support tickets. That warning matters because wallet hacks often attract fake recovery links, phishing forms and accounts asking for seed phrases.

For now, affected users should not sign new transactions or move assets without official guidance. SecondFi says the recovery depends on the current state of compromised wallets, so early action may create more risk.

The case now tests whether SecondFi can return funds safely while explaining what failed. It also adds fresh concern for Cardano users as ADA trades near multi-year lows and wallet security remains under review.