SecondFi users left holding the (zero-knowledge) bag as $2.6M ADA hack forces shutdown 🪙

SecondFi is winding down its SecondFi and Yoroi wallet services after attackers stole approximately 16.1 million ADA, worth roughly $2.6 million, through a cryptographic flaw in its wallet software, according to a Wednesday update. The breach affected 374 wallets, the platform said, with an independent investigation by blockchain intelligence provider Groom Lake identifying a sophisticated external actor behind the attack. SecondFi said the probe found indicators potentially linked to North Korea's Lazarus Group, though no attribution has been confirmed.

The company is developing a recovery tool built on zero-knowledge proofs to help affected users regain access to their assets while limiting the information they need to share. The tool remains in testing and is slated for third-party auditor review before a planned August release. SecondFi also said it is preparing wallet export functionality to allow users to migrate to another service, and it has not announced a direct reimbursement plan or indicated whether it would compensate users from its own funds.

The update came nearly a month after SecondFi first disclosed the exploit in late June, and it has drawn frustration from users still waiting for a clear path to recover or migrate their holdings. Earlier guidance from the platform advised affected users not to restore recovery phrases into new Cardano wallets, saying that moving funds elsewhere "does not mitigate the risk" while SecondFi investigated. On June 27, SecondFi said it had identified a recovery path and expected to begin the process within about two weeks after completing testing and security reviews.

"But many of us were told our funds could be recovered within two weeks. Now we're being asked to wait even longer," one user wrote in response to SecondFi's Wednesday update. Cointelegraph contacted SecondFi for details on potential reimbursement plans but did not receive a response by publication time, and EMURGO also did not respond to earlier requests for comment. SecondFi's latest update positions the recovery tool's August launch as the next milestone for users awaiting next steps.