SecondFI has developed an asset recovery tool for users affected by a $2 million exploit in June, but is delaying its public release while it completes security checks. The company identified the incident as a deterministic nonce derivation flaw in its software signer that affected 374 Cardano wallets and enabled attackers to mathematically reconstruct private keys from public blockchain data after transactions were signed. On Aug. 3, 2026, SecondFi hired zkSecurity to independently audit its proof-tool repository. The system uses zero-knowledge proofs (cryptographic proofs that reveal no underlying secret) to let users demonstrate control of a Cardano wallet credential without exposing a seed phrase, private key or wallet derivation path. It is designed to run in a web browser, allowing proof generation locally rather than sending sensitive wallet information to a remote server. zkSecurity found and SecondFi fixed two high-severity issues in upstream code, and the auditor reviewed and tested those fixes. The review also identified two low-severity issues in SecondFi's repository that remain open but were judged not practically exploitable. SecondFI plans another audit of the recovery smart contract (self-executing blockchain code) before launch, which the company expects in the coming weeks subject to that audit and final production checks.