SecondFi targets two-week recovery after wallet breach

• SecondFi said it expects to restore funds to users affected by a wallet vulnerability within approximately two weeks.
• Attackers stole about 16 million Cardano (CRYPTO:ADA), worth around US$2.4 million, from 374 wallet addresses, while emergency measures secured an additional 129 million ADA.
• The company has completed forensic investigations and security reviews and is building a recovery mechanism before returning assets.

SecondFi, the Cardano (CRYPTO:ADA)-based self-custody wallet formerly known as Yoroi and developed by Emurgo, said it expects to restore assets lost in a late June 2026 security incident within approximately two weeks after completing technical and security checks.

The breach resulted from a vulnerability in SecondFi's wallet generation software that allowed attackers to reconstruct private keys using publicly available blockchain data, affecting individual wallet addresses rather than the Cardano network itself.

Emurgo CEO Phillip Pon said, "We've identified a clear recovery solution tailored to the current wallet states," adding that the team will spend one week building the recovery mechanism before completing a further week of testing and security validation.

Three external attacks drained about 16 million ADA, valued at approximately US$2.4 million, from 374 wallet addresses, while emergency measures secured another 129 million ADA with an independent third-party custodian and an external accounting firm was engaged to verify the protected funds.

Operations remain paused while the recovery process continues, and SecondFi has advised affected users not to import recovery phrases into other Cardano wallets or move funds independently because doing so could interfere with the coordinated recovery.

Blockchain security firm SlowMist estimated the total impact could exceed US$20 million when including other digital assets and NFTs beyond the confirmed ADA losses, although SecondFi has not confirmed that figure.

SecondFi said users should only submit support requests through its official support portal and warned that it will never request private keys, seed phrases or wallet access as scammers continue impersonating the company during the recovery process.

At the time of reporting, Cardano price was $0.1431.