A self-custody wallet relied on by more than a million Cardano users has been breached at its most sensitive layer: the code that generates private keys. SecondFi, the platform formerly known as Yoroi, disclosed on June 23 that attackers exploited a flaw in its web wallet-generation software, draining Cardano coins, tokens, and NFTs from holders who believed their assets were safely under their control.
The team’s preliminary estimate puts the damage near 16 million ADA, roughly $2.4 million at current prices, across about 178 affected wallets. Most of the thefts clustered between June 21 and 22. SecondFi has suspended services, switched to maintenance mode, and taken a snapshot of balances it says could anchor a later recovery.
SecondFi Losses Could Reach 129 Million ADA
The official tally may be a floor rather than a ceiling. SlowMist founder Cos, also known as Yu Xian, tracked the attackers’ on-chain movements and estimated that user losses could ultimately exceed $20 million, involving up to 129 million ADA.
That roughly eightfold gap points to an uncomfortable possibility: many wallets built through the flawed software may not have been emptied yet, but remain exposed. A precise figure, SecondFi says, will follow an independent technical audit.
The nature of the flaw makes the warning unusually direct. Because the weakness lies in how keys were created, the compromised element is the wallet itself, not a password or a device.
Restoring the same recovery phrase into another app changes nothing; holders are told to generate fresh keys with a different provider and move funds without delay. Cardano’s ledger and consensus were never touched, as this was a failure in wallet software, not in the blockchain.
Cardano Exploit Tests Trust Across the ADA Ecosystem
The damage cuts deeper because of SecondFi’s pedigree. Yoroi was built by EMURGO, one of the three entities that founded Cardano, which pushes the accountability question well beyond a single app.
SecondFi is reportedly coordinating its response with core Cardano institutions, yet no compensation plan or timeline has been confirmed. For affected holders, that open question, not the headline dollar amount, is the one that matters most right now.
READ MORE: Worldcoin Price Crashes as Volume Surges Past $500 Million
