SecondFi, the Cardano ecosystem wallet application formerly known as Yoroi, reported a critical security breach on June 23. The incident involved a vulnerability in the platform’s online wallet generation system, which may have exposed the private keys of some users.
178 wallets directly affected in initial findings
Initial investigations revealed that 178 wallets were directly impacted by the breach. Confirmed losses from the incident amounted to 16 million ADA, equivalent to approximately $2.4 million at current prices. In addition to ADA, various digital assets and NFTs were reportedly stolen during the exploit.
SecondFi stated that the root cause of the recent security incident lay in its Cardano wallet generation software. Following the discovery, the platform halted all transactions and urged users to transfer their assets to alternative wallets for safety.
Blockchain security firm SlowMist pointed to an even broader threat landscape, estimating that the total potential loss could exceed $20 million, with up to 129 million ADA at risk. The difference between the confirmed losses and the projected total risk suggests that additional compromised but as-yet untouched wallets may exist within the ecosystem.
Glossary: A private key is a secret code that grants full control over assets in a crypto wallet. If this information is leaked, funds can be transferred from the wallet without the owner’s consent.
| Indicator | Disclosed data |
|---|---|
| Directly affected wallets | 178 |
| Confirmed loss | 16 million ADA |
| Approximate USD equivalent | $2.4 million |
| SlowMist estimated risk | 129 million ADA |
Platform suspended transactions
In response to the breach, SecondFi froze account balances and placed its system in maintenance mode. The platform, which serves over one million users, also issued an urgent warning that all wallets created through the compromised system should now be considered at risk.
SecondFi has yet to share a timeline for compensating affected users. A comprehensive security audit is underway, but detailed results have not been published.
Legacy of Yoroi amplified the impact
The rebranding from Yoroi to SecondFi took place in April 2026. Previously, Yoroi had been recognized as a lightweight wallet developed by Emurgo, one of the three founding entities of the Cardano network. Yoroi was widely used by those seeking a lightweight custody solution for ADA without running a full node.
The incident’s impact is particularly significant because the breach occurred in a wallet with historic ties to the core Cardano ecosystem, not just in a third-party service. This background has raised additional concerns in the Cardano community.
According to SlowMist, total losses related to SecondFi could surpass $20 million, with more vulnerable wallets potentially still at risk of exploitation.
Warnings issued over secondary fraud attempts
Security researchers have warned of a second wave of threats following the breach. Malicious actors are impersonating official SecondFi channels, distributing fake recovery tools to steal users’ information and access their funds.
Experts recommend that anyone who has ever used SecondFi or the former Yoroi web wallet immediately generate new private keys and move their assets to secured wallets. However, SecondFi has not announced when normal operations will resume or when a full security report will be released.
