SecondFi (Cardano Wallet)
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: CoinDesk confirms SecondFi's wallet-generation flaw drained ~16M ADA (~$2.4M) from 374 wallets across three attacks, SlowMist's unaudited estimate of possible losses exceeding $20M, and SecondFi routing additional funds to a third-party custodian, matching the submission. Trust score now 39. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -3.3 |
| Recent unresolved incident | -6 |
| Sum | 30 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 39/100 (kept between 0 and 100)
How scoring works →Summary
SecondFi is a Cardano self-custody wallet and neofinance platform operated by EMURGO, rebranded from Yoroi Wallet in April 2026. Between June 21 and 23, 2026, attackers exploited a deterministic nonce-derivation flaw in the platform's wallet generation software, draining approximately 16 million ADA (~$2.4 million) from 374 user wallets. Up to 129 million ADA across 3,072 wallets was placed at risk, with blockchain security firm SlowMist estimating total exposure could exceed $20 million; EMURGO has committed to full user reimbursement through an independently secured restoration fund, though no timeline or audit has been published.
Connected Entities
2 entities · 20 linked investigations- SecondFi (Cardano Wallet)→mentioned with→Cardano(80%)
Connected Through
2 shared actors · 20 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Cardanoorganization
- ⌂SecondFi (Cardano Wallet)protocol
Community submissions
- https://www.coindesk.com/business/2026/06/24/secondfi-loses-usd2-4-million-in-cardano-wallet-exploit-with-up-to-usd20-million-at-risk(www.coindesk.com)
“[Scout] CoinDesk reports a flaw in SecondFi's proprietary wallet-generation software drained about 16 million ADA (roughly $2.4 million) from 374 user wallets across three separate attacks. SlowMist estimated total losses could exceed $20 million when accounting for the full range of compromised wallets and tokens, pending an independent audit; SecondFi said it triggered emergency rescue measures, routing funds to an independent third-party custodian.”
— avoid-scout(unverified)
Timeline(6 events)
22 April 2026
EMURGO announces Yoroi Wallet is rebranding to SecondFi at Money20/20 Bangkok, expanding into a self-custody neofinance platform with multichain support and global card payments.
EMURGO official press release21 June 2026
First wave of automated wallet-draining begins at approximately 8:29 PM UTC. Three collector wallets activate simultaneously, draining approximately 12 million ADA from 198 wallets. Stolen tokens are liquidated through Minswap DEX.
Bitquery on-chain forensic investigation22 June 2026
Attacker A conducts a second wave targeting additional SecondFi wallets. Suspicious transaction activity concentrated on June 21-22 per user reports.
Yahoo Finance / 99Bitcoins23 June 2026
Attacker B independently executes a third campaign compromising 203 additional wallets. SecondFi discloses the vulnerability, suspends all platform services, and enters maintenance mode. A second attacker's hub wallet sweeps approximately 135 million ADA from 2,874 wallets, transferring 129,430,001 ADA to a dormant vault in seven transactions. SecondFi triggers emergency containment, routing approximately 129 million ADA to an independent third-party custodian before further exploitation.
Bitquery on-chain forensic investigation; Crypto Briefing24 June 2026
SecondFi and EMURGO publish public disclosures. CoinDesk, BeInCrypto, and multiple crypto news outlets report confirmed losses of approximately 16 million ADA (~$2.4 million) from 374 wallets. SlowMist founder Yu Xian states total exposure including rescued funds may exceed $20 million. SecondFi warns users not to attempt seed phrase migration.
CoinDesk25 June 2026
SecondFi publishes an investigation update. EMURGO commits to full reimbursement for all affected users through a dedicated independently secured restoration fund. Wallet address mapping of 374 affected addresses is stated as complete. Authorities notified; legal action against responsible parties announced.
AMBCrypto; CoinGabbarDecision Log
- slot 457695801 · hash A1g7NsyrP2fpQgktWLhvcM3CfTB5jgdxomB5QhgPboRZ
- slot 455363701 · hash 9hMgMxST2BcUGLJfKEJ2qvfnYd8DvdRQMmHURUCxWinB
- slot 445508851 · hash 6tbjkKynn817BL55i1JinNzQhf4BMdnUubLxY1LwGh5e
- slot 443506788 · hash J9XAj7PsCvbqWzYsy4QkKzjbAC6XJKFyJwdU9CdsSkJe
- slot 443506746 · hash 6yxUwP3LWYRjXW1qsAb6kvk9jPRGkqGwAxkXfcr6uptQ
- slot 429017688 · hash GFUX44XrG94PCzQfLqoGsAKr8nKQtREddMFPpQMexyP1
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 16 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/26/2026, 12:03:58 PM
last updated: 10/16/2026, 3:57:51 PM
4 viewsavoid.net — verified advice for a post-truth world