SecondFi Reports $2.4 Million Loss from Cardano Wallet Exploit

SecondFi has confirmed that it suffered a loss of about 16 million ADA, equivalent to $2.4 million, due to three separate attacks that exploited a flaw in its proprietary wallet generation software. The security vulnerabilities affected 374 wallets, and the team swiftly implemented a patch for users who were not impacted.

Before additional funds could be compromised, SecondFi successfully secured another 129 million ADA by routing the assets to a third-party custodian. These measures were confirmed after extensive analysis, with an independent accounting firm involved to verify the secured holdings of these assets.

Blockchain security firm SlowMist estimates that the total losses could exceed $20 million, although this figure remains unconfirmed until an independent audit is complete. As the vulnerability is linked to the address level of the wallet, simply switching seed phrases to another wallet does not offer protection to affected users. Instead, they must submit claims directly to SecondFi.

SecondFi, which was formerly known as Yoroi, emphasized the importance of the patches deployed to mitigate future risks. "The security risk occurs when an affected user signs a transaction," the team stated in a tweet.

Charles Hoskinson, the founder of Cardano, acknowledged the incident, noting that although the losses were relatively modest compared to other high-profile hacks, they still represent a significant stress for affected users. He remarked, "This is the unfortunate reality of crypto."

At the time of the attack, ADA was trading at approximately $0.15, marking its lowest valuation since 2020. This incident underscores ongoing security challenges faced by crypto projects and the necessity for robust protective measures in the crypto ecosystem.