Nobody Knows Who Pocketed $18.5M in ADA — Including the Wallet's Own Builders 🤷

Charles Hoskinson disclosed on June 25 that the identity of the white hat hacker who moved 129 million ADA, roughly $18.5 million, out of vulnerable SecondFi wallets is unknown to Emurgo, the firm that built the platform. Speaking during his X Spaces session "The Bingo Hall," Hoskinson relayed secondhand information from a contributor named "Jer" who attended a meeting between Cardano governance body Intersect and SecondFi's developers: "A member of the Emurgo team said the identity of the white hat hacker is not known to Emurgo… or at least [Emurgo] said it is not affiliated with Emurgo." That qualifier leaves open whether Emurgo is genuinely in the dark or carefully managing its public exposure.

ADA price has dropped 21% over the past two weeks and is now trading near $0.145, multi-year lows that sit roughly 95% below the asset's all-time high. The hack did not break the Cardano protocol; every party from Intersect to Hoskinson has stressed that the vulnerability was entirely at the wallet application layer, but the reputational damage to the ecosystem has been reflected in $ADA's market pricing.

SecondFi, one of the largest Cardano wallet generators and formerly known as Yoroi Wallet, suffered a critical flaw in its key-generation software. Three external attackers drained approximately 16 million ADA ($2.4 million) from 374 addresses across four distinct draining events. The separate 129 million ADA movement was framed by SecondFi as an emergency rescue operation, routed to "an independent, qualified third-party custodian" held for the benefit of affected addresses.

Cybersecurity firm SlowMist has estimated total exposure could exceed $20 million. SecondFi took a final balance snapshot on June 26 and said on June 28 that engineering teams remain on track against the estimated two-week recovery timeline, working through multiple technical approaches in parallel to determine the most secure recovery solution for affected users.