SecondFi Hack Update: 16.1M ADA Stolen, Recovery Timeline Explained

SecondFi has released more detail on the wallet security incident that saw about 16.1 million ADA, roughly US$2.6 million, withdrawn from 374 wallets between 21 and 23 June. The update includes a public warning about fake recovery emails, findings from Groom Lake's forensic investigation, and a clearer explanation of the cryptographic flaw involved.

Peter breaks down what SecondFi says happened, including the reported external attacker, the possibility of a second separate attacker, the per-transaction signature issue, and why public transaction data may have been enough to derive affected private key material under certain conditions. The episode also covers the wider discussion around cross-chain wallet code, CTRL Wallet, Yoroi migration, EMURGO tooling and the unauthorised publication of relevant code.

The key safety message is simple: use only official SecondFi channels, do not click recovery emails, never share private keys, and wait for audited recovery and migration tooling rather than trusting anyone offering support through emails, comments or direct messages.

Chapters:
0:00 Fake Recovery Email Warning
1:15 Incident Investigation Update
2:18 Second Attacker Identified
2:56 Cryptographic Root Cause
3:45 Signing Formula Breakdown
5:46 Vulnerable Wallet Library
6:37 CTRL Wallet And Yoroi
8:22 Published Code Question
9:14 SecondFi Wind Down
9:34 Recovery And Migration Tools
11:25 Private Key Safety

What you'll learn:
- SecondFi warned users that fake recovery emails are phishing attempts and that official communication is through its X account and technical support channels.
- SecondFi said the June incident involved approximately 16.1 million ADA, about US$2.6 million, stolen from 374 wallets.
- Groom Lake's independent investigation identified an external actor and suggested the primary operation may be linked to the DPRK-linked Lazarus Group.
- The investigation also identified activity from a second separate attacker affecting a different set of wallets during the same window.
- The root cause described by SecondFi was a subtle cryptographic flaw in how wallet software generated per-transaction signatures.
- The signing issue meant data that should have depended on secret information could under some conditions be computed from public blockchain data.
- SecondFi says the flaw has been patched, new wallets created with corrected software are not known to be affected, and the wallet is being wound down.
- SecondFi is preparing safe migration functionality for early August and a zero-knowledge-proof recovery tool targeted for August after specialist third-party audits.

Links & References:
⚠️ Security Alert: FAKE RECOVERY EMAIL:
- https://link.learncardano.io/m7FsGq
Official SecondFi website:
- https://link.learncardano.io/6llK2P
What happened to SecondFi:
- https://link.learncardano.io/fNJfCu
The signing math:
- https://link.learncardano.io/5Pu20K
Vulnerable Library:
- https://link.learncardano.io/cPTJG9
Andrew Westberg's Opinion:
- https://link.learncardano.io/cVwd7C
EMURGO's internal JS framework Dullahan:
- https://link.learncardano.io/0vu7M5
⚠️ Recovery Update: Bounty Offer Made to Attacker:
- https://link.learncardano.io/lG2331

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano