SecondFi, the Cardano wallet launched in April 2026 as the successor to EMURGO's Yoroi platform, will permanently cease operations following a critical security flaw that enabled the theft of 16.1 million ADA from 374 user wallets. The stolen assets were valued at approximately $2.4 million at the time of the incident in June and roughly $2.8 million based on ADA prices as of July 22, 2026.

Vulnerability Originated in Android Update

The flaw was introduced through an Android application update released on June 8. It caused every transaction signed via the affected app to leak sufficient information for attackers to reconstruct users' private keys using publicly available blockchain data. Because blockchain records are immutable, security experts noted that the compromised keys remain permanently recoverable even after software patches and the platform's shutdown.

EMURGO confirmed that SecondFi will not resume operations. The company said its efforts are now focused exclusively on recovering assets for affected users through a dedicated recovery team, though no reimbursement timeline has been disclosed.

Cryptographic Implementation Failure

The vulnerability stemmed from SecondFi's flawed implementation of Cardano's extended Ed25519 digital signature scheme. Under normal operation, each transaction signature relies on a unique nonce generated from both transaction data and secret key material stored on the user's device, ensuring that signatures cannot expose the underlying private key.

However, SecondFi's Android application generated the nonce using only public transaction information while omitting the required secret component. Cybersecurity researchers subsequently confirmed that this error allowed anyone monitoring the Cardano blockchain to derive users' private keys directly from transaction signatures.

Independent researchers demonstrated the exploit by reconstructing private keys solely from publicly available blockchain records. Security analysts described the implementation failure as one of the most severe cryptographic flaws ever identified in a production cryptocurrency wallet, exceeding the impact of several early Bitcoin wallet vulnerabilities.

On July 22, 2026, SecondFi issued a public statement via X:

An update regarding the recent security incident involving SecondFi What happened to SecondFi Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide… — SecondFi (@secondfiapp) July 22, 2026

Because the compromised data is embedded in permanent blockchain records, EMURGO warned that importing an affected recovery phrase into another Cardano wallet would not eliminate the risk. Users must entirely abandon compromised wallet addresses and generate new keys.

Multiple Attacks Over Two Days

The exploit unfolded between June 21 and June 23 through four separate wallet-draining events. According to EMURGO, three of the attacks were executed by external threat actors, while the fourth was an emergency transfer initiated by the company itself. During that intervention, approximately 129 million ADA was moved to a third-party custodial wallet before attackers could access it. Despite this, 16.1 million ADA could not be secured in time.

Blockchain intelligence firm Groom Lake reportedly concluded that the primary attacker exhibited behavioral and technical characteristics consistent with North Korea's Lazarus Group, though investigators have not officially attributed the attack. A separate, unrelated attacker was also found to have targeted different wallets during the same window.

Parallel Zilliqa Vulnerability Widens Concerns

The SecondFi disclosure coincided with the revelation of a similar cryptographic weakness in Zilliqa's Ledger hardware wallet application. Researchers indicated that the flaw had gone undetected since 2019 and could also enable private key reconstruction after collecting multiple blockchain signatures.

Although the technical mechanisms differed, both vulnerabilities traced back to flawed nonce generation during transaction signing. Nonce-generation errors of this class have a long documented history in applied cryptography, with notable prior incidents including the 2010 PlayStation 3 signing-key compromise and several early Bitcoin wallet losses, where reused or predictable nonces allowed private keys to be recovered from published signatures. Security specialists stated that the incidents demonstrate such errors remain a significant and actively exploitable risk across blockchain wallet software. The simultaneous disclosure of structurally similar vulnerabilities in SecondFi and Zilliqa suggests these cryptographic implementation flaws may be more widespread across the blockchain ecosystem than previously recognized.

SecondFi's closure carries broader significance because EMURGO is one of Cardano's three founding entities, alongside the Cardano Foundation and Input Output Global. The wallet had replaced Yoroi, which served more than one million users over nearly eight years before being rebranded as SecondFi earlier in 2026.

Recovery Measures Under Development

EMURGO stated it is developing a zero-knowledge proof-based recovery portal, currently undergoing third-party audits, with an expected release in August. Additional wallet migration tools are planned to help unaffected users transfer their ADA to alternative wallets. A verification portal will also be made available, allowing users to determine whether their wallet addresses were among the 374 compromised.

The company emphasized that users who relied on Ledger or Trezor hardware wallets for transaction signing were unaffected, as the vulnerability existed solely within SecondFi's Android software and not in hardware wallet firmware.

The incident has intensified scrutiny of self-custody wallet security, underscoring that while users may retain control of their own private keys, the safety of those assets ultimately depends on the correctness of the cryptographic software responsible for generating transaction signatures.