SecondFi has announced the permanent closure of its Cardano wallet, shifting all efforts toward compensating users impacted by a security breach that resulted in the theft of 16.1 million ADA (approximately $2.5 million) from 374 wallets in June 2026. The attackers, linked by developers to the Lazarus Group, exploited a vulnerability in the Android version of the wallet, allowing them to derive private keys. In response, the team secured the remaining 129 million ADA by moving unaffected assets into custodial storage before further losses could occur.
Instead of resuming normal operations, SecondFi outlined a three-stage recovery plan with support from Input Output Group and the Cardano Foundation. The first stage has already launched through an updated application featuring a simplified claims system. Affected users must update the wallet and submit recovery requests via the integrated portal. The second stage, planned for mid-August, will introduce an automated migration tool that unstakes ADA and transfers coins, tokens, and NFTs to another Cardano wallet of the user's choice. The final stage, set for early September, will deploy a zero-knowledge proof refund portal—following independent cryptographic audits throughout August—that enables verification of wallet ownership without exposing seed phrases or private keys.
SecondFi also issued warnings about phishing attempts tied to the shutdown, stressing that it never contacts users via private messages and urging them to download browser extensions only from the verified Chrome Web Store listing and to verify recovery links through the official website.
