Response to the Hack
The creators of the Cardano wallet, SecondFi, have laid out an official plan of action in response to the devastating hack that occurred in June. As a direct result of this incident, the platform will cease its regular operations completely and will not be reinstating normal services. All efforts will now be concentrated on the crucial task of safely recovering remaining user assets and organizing compensation for those impacted.
Compensation Mechanism
To facilitate the return of funds to users, the development team will set a groundbreaking example in the web3 space. Collaborating with Input Output Group and the Cardano Foundation, they are introducing a novel compensation mechanism that uses zero-knowledge proofs.
Details of the Breach
This response comes in light of a significant breach in June 2026, where hackers exploited a flaw in the Android version of the app. This attack, linked to the notorious Lazarus Group, resulted in a loss of 16.1 million ADA, approximately valued at $2.5 million, from 374 wallets. Fortunately, the team managed to protect and save 129 million ADA by transferring those funds to custodial storage before further losses could occur.
Roadmap to Recovery
The roadmap to recovery is set in three distinct phases. However, in the wake of the project’s closure, scammers are already leveraging the situation to deceive users. They have begun circulating fake browser extensions and reaching out through direct messages while posing as legitimate customer support representatives.
Security Advisories
As a precaution, the SecondFi team has issued crucial security advisories to its users. They emphasized that the wallet will never ask for private keys, recovery phrases, or wallet credentials. Additionally, they will not initiate contact through direct messaging or email. The only secured extension can be found on the Chrome Web Store, identifiable by a blue verification badge. Users are urged to verify all links through the official SecondFi website to avoid falling victim to these scams.
