SecondFi has shut down its wallet service after a security breach led to the theft of $2.6 million in ADA tokens.
SecondFi has announced the closure of its wallet service on the Cardano blockchain, following a significant security breach that resulted in the theft of approximately 16.1 million ADA tokens, valued at around $2.6 million.
SecondFi reported that the incident occurred between June 21 and June 23, impacting 374 wallets. They communicated this update via their official Twitter account.
The company confirmed that the Cardano blockchain itself remains secure, and users with hardware wallets were not affected by the breach. The vulnerability was identified in the digital signature creation process, which allowed attackers to sign transactions using reconstructed private keys derived from publicly accessible blockchain data.
According to security experts from Beosin, the issue stemmed from an improper implementation of the Ed25519 digital signature algorithm, where a nonce was generated based on public transaction data instead of secret information. This flaw enabled attackers to recover private keys from published signatures.
Furthermore, SecondFi discovered that a copy of the vulnerable code had been uploaded to a public GitHub repository without authorization. The investigation into the incident is ongoing, and SecondFi is collaborating with law enforcement agencies.
Investigation Reveals Two Attackers
EMURGO, which supports SecondFi, has engaged the blockchain analytics firm Groom Lake to investigate the theft. Preliminary findings suggest that the main attack was executed by a skilled external entity, with potential links to the North Korean Lazarus group. Additionally, a second attacker has been identified, who withdrew funds from a different set of wallets during the same timeframe.
Both attackers executed three waves of automated attacks, affecting a total of 374 wallets. The first wave targeted 171 wallets, while the second targeted 203 wallets.
Future of SecondFi
Despite fixing the vulnerability, EMURGO has decided to permanently shut down SecondFi and the Yoroi wallet. Operations are now focused on refunding users and managing the transfer of remaining assets. Currently, the service allows users to view their balances but prohibits sending or exchanging assets.
A secure wallet export function is set to be launched in early August, enabling users to transfer their assets to new wallets without risking compromised data. A recovery portal utilizing zero-knowledge proofs is also in development for affected users. EMURGO's head, Phillip Phan, previously indicated that refunds would begin within a two-week timeframe after the breach.
