Incident Overview
Published 6/29/2026, 6:04:45 PM
SecondFi and its parent company, EMURGO, have confirmed that a recovery path is identified and "on track" following the $2.4 million exploit in June 2026. Recovery appears highly likely for most affected users because the protocol successfully secured 129 million ADA—far exceeding the 16 million ADA stolen—and has the institutional backing of EMURGO to facilitate a "secure exit" process.
Incident Overview
The exploit targeted a flaw in the deterministic nonce derivation during transaction signing, which allowed attackers to reconstruct private keys using publicly available on-chain data [Source: https://www.google.com/search?q=SecondFi+Cardano+exploit+$2.4M+June+2026+what+happened+how+funds+taken+recovery].
| Metric | Data Point |
|---|---|
| Total Stolen | 16 million ADA (~$2.4 million) |
| Total Secured | 129 million ADA |
| Affected Wallets | 374 addresses [Contested: Some sources report 178 users] |
| Snapshot Date | June 26, 2026 |
| Root Cause | Wallet signer software flaw (nonce derivation) |
Recovery Roadmap and Timeline
On June 27, 2026, EMURGO CEO Phillip Pon stated that assets should begin returning to users in approximately two weeks [Source: https://www.google.com/search?q=SecondFi+Cardano+exploit+$2.4M+June+2026+what+happened+how+funds+taken+recovery].
- Forensic Audit: Completed; the root cause has been isolated to the wallet signer software.
- Asset Protection: 129 million ADA was moved to safety via emergency rescue measures before attackers could reach it [Source: https://www.google.com/search?q=SecondFi+Cardano+exploit+$2.4M+June+2026+what+happened+how+funds+taken+recovery]. [Note: While the 129M ADA secured is confirmed, the specific detail about an "independent third-party custodian" arrangement is not independently verified; sources state funds were "secured by the team."]
- Wallet Checker Tool: Expected to launch in early July 2026. This tool will allow users to verify their eligibility based on the June 26 snapshot.
- Secure Exit Process: A new system is being built to allow users to move funds to new, safe environments rather than returning them to compromised wallets.
Critical Safety Measures
Users are advised to follow strict security protocols during the recovery phase:
- Do NOT deposit new funds into existing SecondFi or Yoroi wallets.
- Do NOT attempt to move funds manually, as this may interfere with the snapshot-based recovery.
- Scam Warning: Be wary of fake "SecondFi Recovery" accounts on social media. The only official support channel is
support.secondfi.io.
Conclusion: While the technical build for the recovery tool is still in progress, the recovery of user funds is considered highly probable due to the successful preservation of the majority of protocol liquidity and the formal commitment from EMURGO leadership. The exact number of affected users remains slightly contested between 178 and 374.