EMURGO plans to start refunds for SecondFi users affected by an exploit in two weeks, impacting 374 wallet addresses and 16 million ADA.
EMURGO's CEO, Phillip Pon, announced plans to start refunding users affected by the SecondFi exploit in approximately two weeks. The incident impacted 374 wallet addresses, resulting in the theft of around 16 million ADA, valued at approximately $2.4 million at the time.
The upcoming week will focus on developing the refund process, followed by a week dedicated to testing the mechanism. EMURGO has advised SecondFi users to refrain from transferring assets and to comply only with official communications. They specifically cautioned against fraudulent messages, reiterating that no private keys, seed phrases, or wallet access is requested by the service.
Four separate incidents of fund withdrawals were reported between June 21 and 23. External attackers executed three withdrawals totaling about 16 million ADA. In response to the threat, the SecondFi team transferred approximately 129 million ADA to a secure custodian to protect the assets from being accessed by the attackers. An external audit is currently being conducted on these funds.
Two wallets linked to the attackers were identified: one associated with 171 compromised wallets and another with 203. Roughly 4 million ADA tied to the theft is under surveillance at a flagged collection address. SecondFi has reached out to law enforcement regarding the situation.
A report from Tibane Labs attributed the exploit to an error in the Ed25519 signature rather than nonce reuse. They revealed that a flawed SDK published on npm by an independent developer replaced the previously verified EMURGO signature module on June 8, allowing for the recovery of the private key from a single signed message.
As of now, EMURGO has not released a detailed technical analysis of the incident nor addressed the findings presented by Tibane Labs. The SecondFi wallet, previously known as Yoroi until April, is a significant player in the Cardano ecosystem, supported by EMURGO, one of the network's three founding organizations.
Notably, the crypto industry experienced a surge in hacks during the second quarter of 2026, with 83 incidents leading to total losses of $755.3 million.
