SecondFi: a wallet rebrand and the incident that followed

SecondFi is the rebranded Yoroi wallet, originally developed by Emurgo, one of Cardano’s founding entities alongside IOG and the Cardano Foundation.

In April 2026 it repositioned itself as a self custodial “neofinance” platform.

Less than 3 months later, users started reporting unauthorised drains around June 22 and June 23, 2026, including early June 23 UTC.

SecondFi disclosed the incident on June 23 around 11:21 UTC, moved the platform into secure maintenance mode, claimed the root cause was isolated, completed on chain analysis and started an independent technical review.

The reported flaw sits in SecondFi’s native Cardano web wallet generation software.

Our analysis suggests predictable randomness in the key generation process, meaning affected private keys could allegedly be reconstructed or accessed.

Victims did not need to sign a malicious transaction. If the attacker had the key, the transaction looked valid on chain.

This was not a smart contract exploit. Not a Cardano L1 bug. Not a normal custodial database breach. It was a drainer enabled by compromised keys.

Attack pattern:

-Fee sponsor wallets funded with ADA were used to pay network fees.

-Victim wallets were drained in rapid bursts.

-ADA, native tokens, NFTs and likely DeFi positions were swept.

-Funds were routed into collector wallets.

Some assets were liquidated through DEX routes or moved toward exchange linked flows.

On chain tracking shows thousands of drain transactions, including partial analysis around 1,961 drain txs.

Known public collector address:

addr1q8g8cgwqw98q2mrzrwgcy3wectdxwem8a8zp9r2mn6wjy7q4x7gcpv39wwurj7n72akw4kd0dgmv72gz4j92fvhn29ss7vuz99

SecondFi confirmed around 16 million ADA stolen, roughly $2.4 million at the time, plus other tokens and NFTs.

Early figures referenced about 178 affected wallets or stake keys.

Broader community tracking later estimated around 2,593 users impacted.

SlowMist founder Cos warned damages could exceed $20 million, with broader clustering pointing to up to roughly 129 million ADA in possible affected or attacker linked flows.

Confirmed loss and possible exposure are not the same thing. Some wallets may not have been drained yet, and forensic clustering is still being refined.

SecondFi says it took a full balance snapshot, paused the platform, started an independent review and is working with IOG, Cardano Foundation, Intersect MBO and SundaeSwap to monitor flows.

It also said it wants to support affected users and make them whole where possible. As of June 24, 2026, there is no final public audit report, no full victim list, no full transaction dump and no clear compensation timeline.

Charles Hoskinson acknowledged the incident, said every lost ADA matters, and clarified that IOG does not own or control Emurgo. Compensation responsibility sits with Emurgo and SecondFi.

The Cardano chain itself kept running normally. That does not make this less serious. A wallet that fails at safe key generation destroys the entire premise of self custody. “Your keys, your coins” only works if the keys were generated safely in the first place.

Anyone who generated a wallet through SecondFi or Yoroi’s web tool should treat it as compromised, move funds to a new unrelated wallet, preferably hardware backed, and never reuse the old seed.

Keep in mind;

Recovery DMs are scams. Fake support links are scams.

Anyone promising instant recovery is probably trying to drain what is left.