SecondFi has updated its investigation into a security incident affecting its Cardano wallet service. The probe was commissioned by EMURGO and carried out by independent blockchain forensic firm Groom Lake. According to Foresight News, the findings indicate two separate attackers were involved: the primary attacker used advanced techniques with some indicators overlapping known Lazarus Group activity, while a second attacker acted independently through different wallet addresses.
The company said the root cause was a cryptographic flaw in wallet software used to generate per-transaction signatures, which could theoretically allow an attacker to derive private key material from public on-chain data. The flawed code had previously been published without authorization to a public GitHub repository, and SecondFi said it continues to assess the matter and has cooperated with authorities.
The vulnerability has been fixed, and new wallets created with the patched version are not affected. SecondFi said it will close SecondFi and Yoroi wallets. For asset recovery, the company is developing a zero-knowledge proof-based recovery tool expected in August 2026, and it plans to introduce a wallet export feature before then so users can move assets to other wallets.
SecondFi previously said the incident involved four fund outflows, with three carried out by external attackers, resulting in about 16 million ADA being transferred from 374 addresses. It also said it moved about 129 million ADA to an independent third-party custodian for safekeeping.
SecondFi Confirms Two Attackers in Security Incident Probe and Plans Wallet Shutdown
2026-07-22 08:23:40
Disclaimer:
1. The information provided does not constitute investment advice. Investors should make independent decisions and bear all risks themselves.
2. The copyright of this content belongs to the original author. The views expressed herein are solely those of the author and do not represent the stance or position of this website.
Previous article：
地缘政治 | 以色列军方：监测到伊朗发射火箭弹
