SecondFi's wallet generator coughed up the keys, and roughly $2.4M in $ADA walked out the door 🗝️

SecondFi disclosed on June 23 that a flaw in its wallet-generation process exposed the private keys of Cardano [$ADA] wallets created through the service, creating an entry point for an exploit. The vulnerability allowed potential attackers to gain unauthorized access to the affected accounts, with on-chain investigators tracking several addresses linked to the incident. The exploit produced losses of approximately 16 million ADA, worth around $2.4 million, though SecondFi later indicated total exposure could reach as high as 129 million ADA when other tokens and NFTs held in the affected wallets are included. SecondFi has temporarily suspended service and entered maintenance while containment work continues. The company said it has isolated the affected wallets and captured a full balance snapshot during the response.

SecondFi's initial investigation identified roughly 178 wallets impacted by the exploit, but the team later determined the threat activates whenever affected users sign transactions with the compromised addresses. SecondFi described that finding as a fundamental change to the threat model and to the way security teams assess the vulnerability, since exposure is no longer limited to the originally flagged addresses. The platform has not announced a timeline for resuming service or for a full accounting of all assets exposed across the broader wallet set.

Community reaction to the disclosure has grown increasingly hostile, with users publicly contesting the project's guidance and tone. One user directly challenged the team, stating, "Millions were lost. People's life savings vanished." The criticism escalated with separate claims that "nobody trusts anything being posted" and that disabling comments "says more than any statement ever could." Those responses indicate the incident has moved beyond the immediate financial loss and into a wider confidence problem for SecondFi as it works through its containment and disclosure process.