Key points:
- SecondFi has fixed this wallet vulnerability and has released a patch as announced today, June 24, 2026.
- The platform has moved 129 million ADA to a security manager to protect users’ money.
- The platform encourages users not to sign transactions or transfer their recovery statements to another Cardano wallet from now on.
SecondFi, a stable financial platform built on the Cardano blockchain that faced a security threat yesterday, announced today, June 24, 2026, via X, that it has identified and fixed a security issue that affected some Cardano wallet addresses. The company says the bug was at the address level and could lead to theft unless the user signed in. A patch has already been released for non-compromised wallets. Normal service is expected to resume soon for those users.
What happened
Four separate draining events targeted SecondFi wallets. Three of these incidents were carried out by external attackers and resulted in the loss of approximately 16 million ADA from 374 addresses. During the ongoing period, SecondFi implemented emergency rescue measures to stop further losses. As a result, approximately 129 million ADA was transferred to an independent administrator where it is safely stored for the benefit of the affected wallets.
Why Password Recovery Is Not Safe
SecondFi warns that restoring your password to another Cardano wallet will not eliminate the threat. The risk exists at the address level and is only valid if the transaction is signed by the affected wallet. Transferring seed words to another wallet does not change the address of the fraud and may leave funds in the open. X notes also warned users to avoid repurposing their recovery words in any other Cardano wallet until SecondFi issues specific guidance.
What SecondFi Has Done to Protect Money
- The release of contactless wallets, allowing many users to resume normal activities soon.
- Emergency transfer of available funds to a third party custodian to protect the assets while the situation is being resolved.
- Working with an external accounting firm to conduct a special audit and independent audit. The affected wallets have been isolated to prevent further use.
How Users Can Claim Goods
SecondFi is coordinating a process to ensure that affected users can return their assets safely. Affected users are asked to file a complaint via the SecondFi support portal at support.secondfi.io. The company says it will work with an independent auditor and an accounting firm to confirm its proposal before releasing the funds.
If the user’s wallet is not listed as affected, then the user should switch to the default version and continue successfully. However, if the wallet is affected, then the user does not have to sign any transactions and does not have to restore their password to restore others. Cardano bag.
Third Party Verification and Transparency Methods
SecondFi has brought in an independent accounting firm to audit the savings and verify the savings held by a third-party custodian. This independent check is intended to give users confidence that the funds are correct and that the claims are visible. The company also said that it will publish technical information about the cause and duration of the attack after the rescue and confirmation.
History of the Event
On June 23, 2026, SecondFi wrote on X and acknowledged that some Cardano wallets were affected by a security issue. Onchain data and security comments indicate that the spill events may have started on June 21 or June 22, before the full disclosure of the company was posted. SecondFi later said that the error was at the level of the address and that the vulnerability appears if the user signs the contract, which is why simply retrieving the password in another wallet may not be enough.
Charles Hoskinson said that the application shows “the true nature of crypto,” adding that the title’s loss may seem less than other hacks (e.g. Kelp DAO and Drift work which happened in April 2026). However, according to him, the whole problem is still painful for users who lost all their ADA.
Also Read: Cardano Card Expands to Japan via SecondFi and Slash Partnership
