A security breach at SecondFi resulted in the withdrawal of 16 million ADA, prompting emergency measures and collaboration with Cardano ecosystem stakeholders.
On June 23, SecondFi, a wallet service operating on the Cardano blockchain, reported a significant security breach, prompting the platform to enter secure maintenance mode. This precautionary measure temporarily halted all user transactions as developers investigated the incident.
In response to the breach, SecondFi stated, "We have taken a full snapshot of balances as part of our response. This is being handled as a coordinated effort to protect the broader Cardano ecosystem."
By June 24, it was confirmed that hackers had siphoned off approximately 16 million ADA from 374 addresses, translating to an estimated loss of $2.4 million, based on the ADA price of roughly $0.146 at the time.
To mitigate potential losses, SecondFi implemented emergency measures to safeguard the remaining 129 million ADA, transferring these funds to a qualified third-party custodian.
Details of the Incident
The SecondFi team revealed that they are collaborating closely with various stakeholders in the Cardano ecosystem, including Input Output Global (IOG) and the Cardano Foundation. They have identified the root cause of the issue, which pertains to the wallet's transaction signing process, and have released a fix for unaffected wallets.
SecondFi warned users against restoring their seed phrases in other wallets, emphasizing that the risk is tied to the address level.
Four withdrawal events were recorded: three executed by the hackers and one by SecondFi to protect assets, though the latter was not explicitly confirmed by the team.
Mitchell Amador, CEO of Immunefi, indicated that the vulnerability stemmed from the wallet's software exposing private keys generated by the platform itself, rather than an issue with the Cardano blockchain.
Clarification from IOG
Charles Hoskinson, founder of Cardano, made it clear that SecondFi is not affiliated with IOG, stating, "We have no equity, control, ownership, or business relationship." He likened the situation to asking Apple to address issues with a Microsoft product, emphasizing the independence of each entity.
“We did not write this code and are not associated with it,” Hoskinson reiterated.
SecondFi, previously known as Yoroi Wallet, is supported by EMURGO, a pivotal entity in the Cardano ecosystem, which aims to promote blockchain technology and asset tokenization. This incident raises further concerns about security within the Cardano environment, especially following previous incidents involving significant ADA losses.
