SecondFi has confirmed that its recent security incident led to the theft of 16 million ADA, worth about $2.4 million at current prices. Initial findings show that 178 wallets were directly affected, and the stolen assets reportedly included not only ADA but also other digital assets and NFTs.
Wallet generation software identified as the source
According to SecondFi, the root cause was tied to its Cardano wallet generation software. After discovering the issue, the platform halted all transactions and urged users to move funds to other wallets. It also warned that any wallet created through the compromised system should now be treated as exposed.
SecondFi froze account balances and switched the platform into maintenance mode. The company says it serves more than 1 million users. It has not shared a compensation timeline for affected users, and a full security audit is still in progress without published findings.
SlowMist sees a much larger risk window
Blockchain security firm SlowMist put the potential exposure well above the confirmed loss. The firm said total losses linked to SecondFi could exceed $20 million, with as much as 129 million ADA still at risk. That gap suggests there may be additional compromised wallets that have not yet been drained.
Researchers also warned of a second layer of attacks after the breach. Threat actors are reportedly impersonating official SecondFi channels and pushing fake recovery tools designed to capture user information and gain access to funds. Security experts advised anyone who has used SecondFi or the former Yoroi web wallet to generate new private keys at once and move assets into secured wallets.
Yoroi history adds weight to the incident
SecondFi was rebranded from Yoroi in April 2026. Yoroi had previously been known as a lightweight wallet developed by Emurgo, one of the three founding entities behind the Cardano network. Because the breach involves a wallet product with long-standing ties to the Cardano ecosystem, the incident has drawn added scrutiny inside the community.
As of publication, SecondFi has not said when normal operations will resume or when its full security report will be released.