SecondFi secures 129M ADA after exploit

• SecondFi said a vulnerability in its Cardano wallet software allowed attackers to drain funds from 374 user addresses.
• The company secured approximately 129 million ADA through emergency measures and moved the assets to an independent custodian for affected users.
• SecondFi traced the incident to an address-level issue involving wallet key generation rather than a flaw in the Cardano blockchain itself.

SecondFi, a wallet operating on the Cardano (CRYPTO:ADA) blockchain, said it identified the cause of a security breach that affected approximately 16 million ADA, or about US$2.4 million, across 374 addresses.

The company said the exploit originated from a vulnerability in its wallet generation software, which affected users when signing transactions and exposed private keys generated by the platform.

“SecondFi’s wallet software exposed the private keys it generated,” said Immunefi Chief Executive Officer Mitchell Amador.

SecondFi said it implemented emergency measures that secured roughly 129 million ADA and transferred the assets to an independent third-party custodian while user verification procedures are completed.

The company advised affected users not to restore recovery phrases into other Cardano wallets because the underlying risk could remain present, and there was no immediate market reaction following the announcement.

Cardano founder Charles Hoskinson said SecondFi is not affiliated with Input Output Global and stated that the company had no ownership, control or business relationship with the wallet provider.

SecondFi rebranded from the Yoroi wallet in April 2026, while Input Output Global said its incident response team has been assisting the company and that an independent security audit has been requested.

At the time of reporting, Cardano price was $0.1477.