A security vulnerability in SecondFi, the Cardano wallet formerly known as Yoroi, has exposed the private keys of user wallets and drained millions in crypto assets. The platform disclosed the exploit on June 23, immediately suspending all services and urging users to migrate their funds to new wallets.
What happened and how bad is it
The vulnerability sits in SecondFi’s web wallet generation software, which allowed unauthorized access to the private keys of certain users’ wallets. Approximately 178 wallets were directly affected in the initial assessment, with confirmed losses of around 16 million ADA, valued at roughly $2.4 million, plus additional unspecified tokens and NFTs.
But the initial damage tally may only be the opening act. Blockchain security firm SlowMist conducted its own evaluation and estimated that total potential losses could exceed $20 million, potentially encompassing up to 129 million ADA. The gap between the confirmed $2.4 million and SlowMist’s $20 million-plus figure suggests that many compromised wallets may not yet have been drained, but remain vulnerable.
SecondFi responded by freezing user balances and entering maintenance mode. The platform, which serves over 1 million users, has issued warnings that any wallet generated through its compromised software may remain at risk. Users were told, in no uncertain terms, to move their assets to new wallets immediately.
