The Cardano ecosystem is reeling from a major security breach, as over 16 million ADA were stolen from user wallets in a sweeping exploit. According to initial reports, the incident stemmed from compromised seed phrases in the widely used Cardano wallet, SecondFi. Security firm SlowMist has estimated that the total losses could reach as high as $20 million.
Source of the breach
At the center of the hack is SecondFi, formerly known as Yoroi. Developed by Emurgo Labs, the wallet served as a primary self-custody tool within the Cardano network. Its direct association with Emurgo—a founding entity of Cardano—had positioned SecondFi as a critical component in the ecosystem.
Information shared in the aftermath of the breach revealed that SecondFi completed its transition from Yoroi on June 12. The exploit, however, emerged just days later, raising concerns that the vulnerability might have been rooted not in a third-party service but in the infrastructure of one of Cardano’s core developers.
The SecondFi team announced that the incident occurred at the address level and that the risk was triggered when a transaction was signed. They stressed that simply transferring a seed phrase to another wallet would not resolve the issue and urged users to move their assets to a different type of wallet as quickly as possible.
Warnings issued to users
SecondFi confirmed efforts to isolate compromised addresses. Nevertheless, users were advised to uninstall both the wallet application and browser extensions, and, when possible, to transfer assets to a hardware wallet for greater security. So far, the company has only suspended activity on its own interface.
Researchers have noted that the vulnerability may not be limited to a small set of keys; analyses suggest that all private keys generated via SecondFi might be at risk. The company has also traced the exploit back to its own wallet creation software.
Glossary: A seed phrase is a series of words used to recover a crypto wallet. If this phrase is compromised, it can be used to regenerate the private keys and move assets without authorization.
Attacker’s methods and on-chain findings
Users reported significant ADA losses, with data showing that the attacker’s address became active in the early hours of June 24. Though outflows appear to have ceased recently, investigations revealed that stolen Cardano NFTs are being stored in a separate wallet.
Blockchain researchers assessed that the intruder may have previously obtained access to a private key database. As a result, when a user initiated a recovery transaction, the attacker could identify the address and siphon funds before the legitimate user completed the process, leading some users to only notice the loss upon attempting a transaction.
Additional research indicated that the attacker’s initial funding originated from a Binance account—a fact that could aid efforts to track the perpetrator’s identity.
ADA price impact and compensation debate
Following the security breach, ADA’s price fell 2.9% over the last 24 hours, touching $0.15. From its level of $0.42 at the start of 2026, ADA has lost more than 54% of its value year-to-date and has dropped out of the top 20 crypto assets by market capitalization.
With 352.4 million ADA reportedly still in the Cardano treasury, debate has emerged within the community over whether these reserves could be used to compensate affected wallet holders. However, there is currently no official decision on this matter.
