SecondFi completes final snapshot and starts refunds after Cardano wallet attacks

Recovery remains on track after a wallet-generation flaw exposed private keys, draining about 16 million ADA from 374 Cardano addresses and prompting scam warnings, with claims now open and operations still paused pending audits.

ADA

30d ago

Fact Check

Official SecondFi and EMURGO posts plus Cryptopolitan, Cointelegraph, and KuCoin coverage all confirm the core facts: June 21-23 attacks hit 374 wallets via a wallet-generation flaw that exposed/allowed reconstruction of private keys, claims are open via the official support portal, ~129 million ADA was secured (moved to a custodian by parent company EMURGO to prevent further losses), and operations are paused/in maintenance mode pending external security audits. The 129M ADA figure refers to funds protected from further attack, not the ~16M ADA actually stolen, consistent with the claim's wording 'secured.' The only minor caveat is that the claim's phrasing 'starts refunds' is slightly ahead of reality — SecondFi took the final snapshot and opened claims but estimated actual disbursement ~2 weeks out — so the assessment is likely_true rather than fully unqualified.

Summary

SecondFi said it has completed its final balance snapshot and begun processing refunds for users affected by Cardano wallet-draining attacks between June 21 and 23, with claims open through its support portal after the June 26 snapshot. The company said a deterministic nonce derivation error in its software signer let attackers reconstruct private keys from publicly available on-chain data, and its investigation found two separate actors compromised 374 wallets in total. SecondFi said the incident drained about 16 million ADA, estimated at roughly $2.4 million, and it warned users to stay alert for phishing and other follow-on scams as recovery continues. The company and parent entity EMURGO said they have secured about 129 million ADA through emergency measures, while 4.02 million ADA tied to the exploit is being tracked in a monitored collection wallet. Normal operations remain paused pending external security audits and a full security review.

Terms & Concepts

private keys: Secret codes used to control crypto funds.
balance snapshot: A record of wallet balances at a specific time used for recovery or reimbursement.
phishing: A scam that tries to trick users into revealing keys, passwords, or other sensitive data.