Cardano-focused wallet provider SecondFi says it will shut down its SecondFi and Yoroi wallet services after a security incident exposed a cryptographic weakness in its wallet software. In a public update published Wednesday on X, the company stated that attackers stole about 16.1 million ADA—valued at roughly $2.6 million at the time of disclosure—affecting 374 wallets.
The news arrives nearly a month after SecondFi first disclosed the exploit in late June, when it said it had identified a path toward recovery and expected the process to begin soon after security reviews. Now, users are being told to wait for new tools targeted for release in August, even as the company prepares to wind down operations.
SecondFi’s Wednesday update marks a decisive shift from its earlier stance that recovery would follow after additional work. The company said the attackers exploited a cryptographic flaw in its wallet software to gain access to user funds, resulting in the theft of approximately 16.1 million ADA.
SecondFi’s post further states that an independent investigation conducted with blockchain intelligence provider Groom Lake identified a “sophisticated external actor” and found indicators potentially consistent with North Korea’s Lazarus Group. Importantly, SecondFi’s update does not claim confirmed attribution.
For affected users, the immediate practical consequence is that the wallet services are being phased out rather than remaining fully operational while remediation continues. That increases the urgency for recovery and migration options, since users may no longer be able to rely on the same support channels tied to the compromised service.
SecondFi said it is building a recovery tool intended to help exploited users retrieve assets while limiting what information they must disclose. According to the company, the approach uses zero-knowledge proofs, a technique designed to prove certain facts without revealing underlying sensitive data.
The wallet provider added that the tool is still in testing and will be reviewed by a third-party auditor before it is released. SecondFi’s stated goal is an August launch, aligning with its broader plan to provide recovery and migration functionality on a delayed timeline.
Alongside recovery, SecondFi said it is also preparing wallet export functionality. The export feature is meant to help users move their assets to another service, giving them a concrete migration path even if SecondFi and Yoroi services are being wound down.
However, SecondFi did not announce any direct reimbursement plan, nor did it specify whether it would compensate users from its own funds. For many in the Cardano ecosystem, that omission matters as much as the technical plan, because wallet recovery typically depends on the quality and timeliness of tooling rather than on centralized discretion.
SecondFi’s operational change has been met with frustration from users who say earlier messaging implied a faster recovery window. Nearly a month after the initial disclosure, some users claim they still lack a clear, dependable path to regain or migrate their funds.
In guidance SecondFi posted earlier during the investigation, the company advised affected users not to restore recovery phrases into new Cardano wallets. The stated rationale was that moving funds elsewhere “does not mitigate the risk” while SecondFi investigated the incident.
SecondFi’s recovery expectations were also time-bound during the initial disclosure phase. On June 27, according to earlier reporting by Cointelegraph, the company said it had identified a recovery path and expected to begin the process within roughly two weeks after completing testing and security reviews. Wednesday’s update effectively pushed that horizon further out, saying recovery tools were now targeted for August due to ongoing development and review.
One user response posted to X criticized the mismatch between the earlier “two weeks” expectation and the updated delay, stating that they had been told recovery could occur within that shorter timeframe but are now being asked to wait longer.
Cointelegraph attempted to obtain further details from SecondFi about possible reimbursement plans but did not receive a response by publication time. The report also notes that EMURGO did not respond to earlier requests for comment.
Wallet security incidents are often assessed not just by how much was stolen, but by how quickly users can safely regain control of funds and whether the remediation process is both verifiable and operationally feasible. In this case, SecondFi’s plan—recovery via zero-knowledge proofs plus export tools—shows an effort to create a safer workflow for exploited users, particularly by reducing the need to share sensitive material.
At the same time, the decision to wind down wallet services introduces a second challenge: continuity. Even a well-designed recovery tool can become harder to coordinate when a provider is closing down and users need to migrate away during remediation. For impacted users, the next steps hinge on whether SecondFi’s August release aligns with its testing and third-party audit schedule, and whether the export function is available in a way that supports migration without introducing new risk.
For the wider Cardano ecosystem, the incident also underscores the fragility of cryptographic assumptions inside wallet software. The company has not attributed the attack with certainty, but the mention of indicators possibly linked to Lazarus suggests that the event may reflect a persistent, externally driven threat model rather than an isolated bug.
As August approaches, the most important questions for affected users are straightforward: will the recovery tool and wallet export features ship on schedule, will they work reliably for all impacted wallets, and will SecondFi clarify whether any compensation is planned. Until those details are confirmed, the practical recovery timeline—and the safety of any migration steps—remains the central uncertainty.
This article was originally published as SecondFi to shut down after $2.6M ADA loss tied to wallet flaw on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.
