Cardano Wallets Hit By SecondFi Exploit As Private Key Flaw Sparks Security Warning

SecondFi, a service previously associated with the Yoroi wallet brand, has suspended operations following the discovery of a critical vulnerability in its proprietary web-based wallet generation software. The flaw reportedly exposed private keys, enabling attackers to access user wallets and steal ADA tokens. Initial reports estimated losses of around 16 million ADA, approximately $2.4 million, affecting 374 wallets. Security firm SlowMist later warned that the total impact could exceed 129 million ADA, or more than $20 million in assets, though these figures remain subject to confirmation.

The incident has sparked urgent security warnings for affected users. Crucially, the vulnerability is isolated to SecondFi’s wallet-generation software and not the Cardano blockchain protocol itself. This distinction is important: the Cardano network was not hacked or compromised at the protocol level. The risk is limited to wallets whose private keys were generated or exposed insecurely through SecondFi’s service.

Affected users are strongly advised not to restore compromised seed phrases into any other wallet, as importing the same recovery phrase merely transfers the compromised credentials to a new interface. Additionally, users should be wary of unverified recovery links or third-party refund platforms, which often emerge after exploits as phishing attempts.

The next steps depend on SecondFi publishing a full post-mortem, security firms confirming the final scope, and any official recovery or compensation plans. For the Cardano community, this event highlights that blockchain security extends beyond the protocol layer; wallet generation, seed phrase handling, and user interfaces can become critical points of failure.

Source: https://bitcoinist.com/cardano-wallets-hit-by-secondfi-exploit-as-private-key-flaw-sparks-security/