{"id":32860,"date":"2026-06-24T07:25:23","date_gmt":"2026-06-24T07:25:23","guid":{"rendered":"https:\/\/bitunikey.com\/news\/cardano-project-secondfi-faces-20m-loss-warning-after-flaw\/"},"modified":"2026-06-24T07:25:33","modified_gmt":"2026-06-24T07:25:33","slug":"cardano-project-secondfi-faces-20m-loss-warning-after-flaw","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/cardano-project-secondfi-faces-20m-loss-warning-after-flaw\/","title":{"rendered":"Cardano project SecondFi faces $20m loss warning after flaw"},"content":{"rendered":"<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">SecondFi, a Cardano ecosystem wallet project, said it has traced a recent security incident to its native Cardano web wallet generation software.\u00a0<\/p>\n<div id=\"cn-block-summary-block_5ed21799c7dc3225e5d209e461d09d63\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>SecondFi traced the breach to its Cardano wallet generation software after pausing platform activity Tuesday.<\/li>\n<li>SlowMist founder Cos said suspected hacker wallets suggest potential losses could exceed $20 million overall.<\/li>\n<li>The incident adds pressure on Cardano as ADA trades near multi-year lows again this month.<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>The team said it had contained the issue and paused affected services while it reviewed the full scope.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cWe have isolated the root cause of the recent security incident,\u201d said SecondFi in a security update. \u201cThe issue was confined to our native Cardano web wallet generation software.\u201d<\/p>\n<\/blockquote>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8 SECURITY UPDATE: Root Cause &amp; Blast Radius Confirmed<\/p>\n<p>We have isolated the root cause of the recent security incident. The issue was confined to our native Cardano web wallet generation software.<\/p>\n<p>Our team has completed an onchain analysis to determine the scope of impact, and\u2026<\/p>\n<p>\u2014 SecondFi (@secondfiapp) <a rel=\"nofollow\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/x.com\/secondfiapp\/status\/2069380358291001425?ref_src=twsrc%5Etfw\">June 23, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>SecondFi said its on-chain review put the preliminary scale at around 16 million ADA. The team also said it was working with a blockchain security firm on an independent technical review.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\"><strong>SlowMist founder sees larger Cardano loss risk<\/strong><\/h2>\n<p>SlowMist founder Cos, also known as Yu Xian, said the damage could be far larger than SecondFi\u2019s early figure. He said the estimate depends on whether two Cardano addresses he tracked are confirmed as attacker wallets.<\/p>\n<p>\u201cThe users of this wallet have likely lost over $20 million,\u201d said SlowMist founder Cos in an X post. He said the possible loss may involve more than 129 million ADA and other tokens.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"ja\" dir=\"ltr\">\u6211\u5bf9 Cardano \u751f\u6001\u5176\u5b9e\u633a\u964c\u751f\u7684\uff0c\u6628\u665a\u56f4\u89c2\u4e86\u4e00\u665a\uff0c\u4f46\u5982\u679c\u4ee5\u4e0b\u90fd\u662f\u9ed1\u5ba2\u5730\u5740\uff08\u4ece\u884c\u4e3a\u4e0a\u5e94\u8be5\u662f\uff09\uff1a<\/p>\n<p>addr1q8g8cgwqw98q2mrzrwgcy3wectdxwem8a8zp9r2mn6wjy7q4x7gcpv39wwurj7n72akw4kd0dgmv72gz4j92fvhn29ss7vuz99\u2026 <a rel=\"nofollow\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/t.co\/gFxun3Wfdo\">https:\/\/t.co\/gFxun3Wfdo<\/a><\/p>\n<p>\u2014 Cos(\u4f59\u5f26)\ud83d\ude36\u200d\ud83c\udf2b\ufe0f (@evilcos) <a rel=\"nofollow\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/x.com\/evilcos\/status\/2069586691535655276?ref_src=twsrc%5Etfw\">June 24, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>Cos later <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/secondfiapp\/status\/2069380358291001425\" target=\"_blank\" rel=\"nofollow\">said<\/a> the transaction pattern suggested an attacker may have obtained a batch of mnemonic phrases or private keys before moving funds over many hours. He said the transfers appeared to move from larger amounts to smaller ones.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Users wait for final review<\/strong><\/h2>\n<p><a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/cardano.org\/apps\/secondfi\/\" target=\"_blank\" rel=\"nofollow\">SecondFi<\/a> has not yet released a final technical report or a detailed compensation plan. The project said it would continue to share updates as the independent review confirms the scope and cause.<\/p>\n<p>The case has drawn attention because the issue involves wallet generation, not only a smart contract or front-end error. If key generation fails, wallets created through the affected software may face direct risk.<\/p>\n<p>SecondFi is the successor to Yoroi and was <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/www.emurgo.io\/press-news\/emurgo-unveils-secondfi-the-self-custodial-neofinance-platform-bridging-everyday-spending-with-onchain-yield\/\" target=\"_blank\" rel=\"nofollow\">launched<\/a> by EMURGO as a self-custody neofinance app for spending, trading, earning and saving. Cardano\u2019s official app catalog lists SecondFi as a self-custody platform built by EMURGO.<\/p>\n<p>As previously reported by crypto.news, Cardano has already faced market and ecosystem pressure this month. ADA fell below $0.20 in June, while several Cardano projects and governance fights drew wider attention. At press time, ADA traded at around $0.15, down almost 3% in the past 24 hours.<\/p>\n<figure class=\"wp-block-image size-large\"><figcaption class=\"wp-element-caption\">Cardano (ADA) price chart, source: crypto.news<\/figcaption><\/figure>\n<h2 class=\"wp-block-heading\"><strong>Security concerns spread beyond Cardano<\/strong><\/h2>\n<p>The SecondFi case adds to a wider run of crypto wallet and platform security issues. In a recent update, crypto.news covered Trezor Safe 7 after Ledger Donjon found a chip flaw, though Trezor said user funds remained safe.<\/p>\n<p>Previously, crypto.news explored Bo Shen\u2019s reopened $42 million wallet hack case. SlowMist had linked that theft to a compromised mnemonic seed phrase, showing how seed phrase exposure can leave lasting recovery problems.<\/p>\n<p>SecondFi users now need to follow only official project channels and avoid support scams. Breach events often trigger fake recovery accounts that ask for seed phrases, private keys or transfers.<\/p>\n<p>The final loss figure remains unconfirmed. For now, SecondFi\u2019s public estimate stands near 16 million ADA, while SlowMist\u2019s Cos says suspected hacker activity could push possible user losses above $20 million.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>SecondFi, a Cardano ecosystem wallet project, said it has traced a recent security incident to its native Cardano web wallet generation software.\u00a0 Summary SecondFi traced the breach to its Cardano&hellip;<\/p>\n","protected":false},"author":1,"featured_media":31430,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-32860","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/32860","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=32860"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/32860\/revisions"}],"predecessor-version":[{"id":32861,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/32860\/revisions\/32861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/31430"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=32860"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=32860"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=32860"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}