Cardano wallet service provider SecondFi has published an update on its security incident, following an investigation commissioned by EMURGO and conducted by independent blockchain forensics firm Groom Lake.
The findings point to two separate attackers. SecondFi said the primary attacker used advanced methods, and some indicators overlap with known activity associated with North Korea’s Lazarus Group. That assessment is still being reviewed. The company added that signs tied to a second attacker were independent from the primary intrusion and involved different wallet addresses.
Cryptographic flaw identified as root cause
SecondFi said the underlying cause of the incident was a cryptographic flaw in the wallet software during the generation of per-transaction signatures. According to the company, the flaw could theoretically allow attackers to derive private key material for affected wallets from public on-chain data.
The company also said the affected code had previously been published without authorization to a public GitHub repository. SecondFi said it is continuing to assess the matter and is cooperating with the relevant authorities in their investigation.
The vulnerability has now been fixed, SecondFi said, and newly created wallets using the patched version are not affected.
SecondFi and Yoroi wallets to be shut down
SecondFi said it will close both the SecondFi and Yoroi wallets.
On asset recovery, the company said it is developing a zero-knowledge-proof-based recovery tool and expects to release it in August 2026. Before that launch, it plans to add a wallet export feature so users can move assets to other wallets.
Previously disclosed losses and fund movements
Foresight News had earlier reported that SlowMist estimated losses from the SecondFi security incident at more than $20 million.
SecondFi later said there were four fund outflow events in total, three of which were carried out by external attackers. Those transfers moved about 16 million ADA out of 374 addresses. The company also said it had transferred about 129 million ADA to an independent third-party custodian for safekeeping.