The Cardano ecosystem wallet SecondFi confirmed a vulnerability in its self-developed wallet generation software, which attackers exploited in three external incidents to transfer 16 million ADA across 374 wallets, amounting to approximately $2.4 million based on the price cited in the report. The team stated that a patch is already available for unaffected users, while affected users must submit claims directly to SecondFi.
The vulnerability occurred at the address layer.
SecondFi stated that the issue was not merely due to mnemonic phrase leakage or a single device being compromised, but rather stemmed from the wallet address generation process. The team explained that the risk is triggered when affected users sign transactions, so importing the mnemonic phrase into another wallet will not mitigate the problem.
This means that even if some users switch their wallet clients, the associated addresses may still remain exposed to the same risk. SecondFi has reminded users on X not to rely solely on migrating their seed phrases, but to file claims through the official process.
The team stated that 129 million ADA have been transferred.
Before the attacker could access additional funds, SecondFi initiated an emergency response by transferring an additional 129 million ADA to an independent third-party custodian. The team stated that it has engaged an external accounting firm to verify these assets and will proceed with subsequent claims and handling based on their findings.
- Confirmed stolen: 16 million ADA
- Number of wallets involved: 374
- Emergency Transfer Protection: 129 million ADA
Total losses may be higher than the confirmed figures
The blockchain security firm SlowMist estimates that, when including all affected wallets and associated tokens, the total loss could exceed $20 million. However, this figure has not yet been independently audited or verified.
Cardano's founder, Charles Hoskinson, also responded to the incident. He stated that, historically speaking, the amount lost in this event is not particularly large, but for affected users, any asset loss represents a real impact.
Additional information: The report noted that ADA's current price is approximately $0.15, near its lowest level since 2020.