SecondFi Wallet Shutdown After $2.6M Theft Due to Signing Flaw

Pluang

SecondFi Wallet Shutdown After $2.6M Theft Due to Signing Flaw

First seen 23 Jul 2026, 12:05 UTC • •70.5

Article Content

1 / 7

Browse articles

ThreatCluster •July 24, 2026 at 11:44 UTC

•SecondFi wallet shutdown followed a $2.6 million theft due to a signing flaw.
•The flaw exposed private keys of 374 wallets, allowing attackers to drain funds.
•Recovery tools for affected users are under development and expected in August.

SecondFi, a Cardano wallet, announced its shutdown after a security breach allowed attackers to steal 16.1 million ADA, valued at approximately $2.6 million. The attack exploited a signing flaw in the wallet's software, which was introduced in a June 8 update. This flaw enabled the private keys of 374 user wallets to be exposed through public blockchain data. An independent investigation suggested links to North Korea's Lazarus Group, although no formal attribution has been confirmed. Users are currently awaiting recovery tools, which are expected to be released in August. The incident marks a significant failure in Cardano's application-layer security, raising concerns about similar vulnerabilities in other blockchain systems. SecondFi will not resume operations, and no reimbursement plan has been announced.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 95d ago How this analysis works

Timeline

2026-06-08

Critical signing flaw introduced in app update

SecondFi's Android app update allowed private keys to be exposed through public transaction data.

2026-06-27

SecondFi identifies recovery path

SecondFi announced a recovery path for affected users, expecting to begin the process within two weeks.

2026-07-06

SecondFi confirms permanent shutdown

EMURGO CEO announced SecondFi would not resume operations and would focus on asset recovery.

2026-07-23

SecondFi announces ongoing development of recovery tools

Users await the release of recovery tools based on zero-knowledge proofs, targeted for August.

More articles in this cluster (6)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

Lazarus Group

Technique (1)

Data Breach

Organization (2)

SecondFi
Cardano

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Affected Platform (1)

Android

Relationships

Lazarus Group uses Data Breach
Lazarus Group targets SecondFi
Lazarus Group targets Cardano
Lazarus Group related to CWE-200 - Exposure of Sensitive Information
Lazarus Group related to Android

Following this threat?

Track Lazarus Group and SecondFi in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…