SecondFi Hack

Reported loss $2.4M
Cardano
Weak Key Generation

What happened

Between June 21 and June 23, 2026, attackers took about 16.1 million ADA (about $2.4 million) from 374 wallets created in SecondFi, the Cardano wallet EMURGO launched to replace Yoroi. The Cardano network was not compromised, and hardware-wallet users were not affected. The flaw was in SecondFi's transaction-signing software. It let anyone work out a wallet's private key from transaction data already public on Cardano. Rekt, citing the decompiled Android app (version 10.0.3, released June 8), reports that the signing code built the Ed25519 nonce from the transaction hash alone and left out the secret half of the extended key that should be mixed in. With a nonce anyone could recompute, a single on-chain signature was enough to solve for the private key.

Rekt and SlowMist describe at least two separate attacker groups sweeping the exposed wallets. Before more could be taken, SecondFi moved about 129 million ADA from at-risk wallets to a third-party custodian. SlowMist estimated that total exposure could exceed $20 million. SecondFi confirmed the root cause on June 23 and a patch on June 24. EMURGO funded an asset recovery wallet and first aimed to return funds within about two weeks, but later said recovery was more complex. On July 22, SecondFi said it would not resume operations and would release wallet export tools and a recovery portal in August.

How it happened

  1. A SecondFi user signs an ordinary transaction, and the signature (R, s) and the transaction hash are published on Cardano.
  2. Because the app derived the Ed25519 nonce only from the public transaction hash, the attacker recomputes the nonce from on-chain data.
  3. With the nonce known, the signing equation s = r + H(R, A, M) * a has one unknown, so the attacker solves for the private key a.
  4. The attacker signs transactions from the victim's wallet and drains it. Two groups did this across 374 wallets between June 21 and 23.
  5. SecondFi moved about 129 million ADA from still-exposed wallets to a custodian to stop further drains.

Protocol details

Classification Key Compromise
Protocol Type Wallet
Implementation language Haskell

Evidence

Same attack technique

Browse all hacks →
Bitcoin RRWallet $2.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes