Pavlo Kot

SecondFi exploit on Cardano may have cost users more than $20 million

SecondFi exploit on Cardano may have cost users more than $20 million
SecondFi wallet exploited

​The team behind SecondFi has disclosed a security breach caused by a vulnerability in its proprietary Cardano wallet generation software. While the project estimates that approximately $2.5 million was stolen, blockchain security researchers believe total user losses could exceed $20 million.

According to the developers, the vulnerability affected only the project's official wallet. SecondFi has completed its on-chain investigation and hired an independent cybersecurity firm to verify the findings.

The team warned that the flaw is tied to wallet addresses and manifests when transactions are signed. As a result, importing the same seed phrase into another Cardano wallet does not eliminate the risk of compromised funds.

An update has already been released for wallets that were not impacted, and the company said normal service is expected to resume shortly.

Hackers stole approximately 16 million ADA

According to SecondFi, the attack consisted of four separate fund withdrawals. Three were carried out by external attackers, who stole approximately 16 million ADA from 374 wallet addresses.

To prevent further losses, the remaining assets were transferred to an independent custodian. The company has also engaged an external auditing firm to verify the amount of funds held in reserve.

Once the investigation is complete, affected users will be able to submit claims for reimbursement.

Researchers estimate significantly larger losses

SlowMist founder Yu Xian (Cos) said blockchain analysis suggests the incident may be far larger than the project's initial estimate.

According to his findings, more than 129 million ADA and other tokens passed through wallets linked to the exploit. If all potentially compromised assets are considered, total user losses could theoretically exceed $20 million.

The SecondFi hack comes as the Cardano ecosystem continues to expand. Developers recently launched the Leios Musashi Dojo public testnet, the network's biggest scalability upgrade in years. Despite that technological progress, the SecondFi incident highlights that the security of user-facing applications remains one of the ecosystem's most critical challenges.

Earlier, Cardano founder Charles Hoskinson said his paper losses since ADA reached its all-time high have exceeded $3 billion.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.
Weekly Top Bonuses
up to $2,500
deposit bonus for all clients
CLAIM BONUS
Your capital is at risk.