SecondFi Suffers $2.4 Million Loss Due to Cardano Wallet Exploit

SecondFi reported that three separate attacks exploited a vulnerability in its wallet generation software, resulting in the loss of 16 million ADA.

SecondFi, formerly known as Yoroi, has confirmed a significant security breach that led to the theft of approximately 16 million ADA, equivalent to around $2.4 million, from 374 user wallets. The attacks, which occurred over three incidents, exploited a flaw in the company's proprietary wallet generation software.

The vulnerability operates at the address level, meaning that users cannot simply safeguard their assets by transferring their seed phrases to other wallets. According to the team, the risk arises when a user signs a transaction from an affected wallet.

In response to the exploit, SecondFi initiated emergency measures, successfully securing an additional 129 million ADA by transferring these funds to a third-party custodian. An external audit has been commissioned to verify the holdings, and affected users are encouraged to submit claims directly to SecondFi.

Blockchain security firm SlowMist suggests that total losses could potentially exceed $20 million when accounting for all impacted wallets and tokens, although this figure remains unverified pending an independent audit. Charles Hoskinson, founder of Cardano, acknowledged the incident and emphasized the emotional toll on those affected, stating, "It hurts them whenever they lose anything. This is the unfortunate reality of crypto." Currently, ADA is trading at around $0.15, marking its lowest value since 2020.