16 million ADA were withdrawn from SecondFi wallets - ForkLog

# 16 million ADA were withdrawn from SecondFi wallets

June 23, the SecondFi team reported a security issue with their wallet on the Cardano blockchain and put the platform into secure maintenance mode. Users were temporarily unable to perform transactions through the interface while developers checked the scale of the incident.

The platform remains in secure maintenance mode, and we have taken a full snapshot of balances as part of our response. This is being handled as a coordinated effort to protect the broader Cardano ecosystem.

We are working closely with the core pillars of our ecosystem:…

— SecondFi (@secondfiapp) June 23, 2026

June 24, SecondFi announced that malicious actors withdrew about 16 million ADA from 374 addresses. According to Cointelegraph, the damage amounted to approximately $2.4 million at an ADA rate of about $0.146 at the time of the incident.

“To prevent a complete loss of funds during the active exploit, emergency measures were launched to protect the available 129 million ADA. Funds are still being transferred to an independent qualified third-party custodian, where they are stored in the interests of the affected addresses,” — the SecondFi team stated.

Details of the incident

The team stated that they are working with participants of the Cardano ecosystem: Input Output Global (IOG), Cardano Foundation, Intersect, and SundaeSwap. On June 24, SecondFi clarified that they identified the cause of the incident and released a fix for wallets that were not affected.

To provide more clarity, we have identified the nature of the incident, it is at the address level. The security risk affects wallet users when a transaction is signed.

Therefore, recovery to another platform or wallet does not mitigate the risk.

🚨 DO NOT restore your… https://t.co/YkjjhL7gEq

— SecondFi (@secondfiapp) June 24, 2026

According to the team, four withdrawal events occurred. Three of them were carried out by malicious actors. The fourth is likely related to the movement of about 129 million ADA by the team itself to protect assets. SecondFi did not disclose this directly.

Mitchell Amador, CEO of Immunefi, told Cointelegraph that the project's software exposed private keys that it generated itself.

He estimates that the issue did not affect the Cardano blockchain but the wallet module responsible for key creation. Because of this, SecondFi recommended users not to restore their seed phrase in another Cardano-based wallet.

IOG’s position

Cardano founder Charles Hoskinson stated that SecondFi is not an IOG product.

It's not an IOG product. We have nothing to do with SecondFi. We have no equity, control, ownership, or business relationship. You are literally asking Apple if they will take care of an issue from a Microsoft product

— Charles Hoskinson (@IOHK_Charles) June 23, 2026

“We have nothing to do with SecondFi. We have no stake, control, ownership, or business relationship,” — Hoskinson said.

SecondFi (formerly Yoroi Wallet) is backed by EMURGO — one of the key players in the Cardano ecosystem. In its documentation, the company describes itself as a co-founder of the blockchain that “stimulates the commercial adoption of blockchain technology and asset tokenization.”

In a separate video, Hoskinson distanced IOG from the incident. According to him, the company does not control EMURGO and cannot speak on its behalf regarding the incident.

SecondFi https://t.co/PVh4CILTHW

— Charles Hoskinson (@IOHK_Charles) June 23, 2026

“We did not write this code and are not associated with it,” — Hoskinson said.

Recall that in November 2025, a “sleeping” Cardano wallet that had been inactive for five years was activated and accidentally exchanged 14.4 million ADA for the stablecoin Anzens through an illiquid pool, losing $6.05 million.

Earlier, on-chain detective ZachXBT called the functioning model of Cardano a “insider enrichment scheme.”