An update regarding the recent security incident involving SecondFi What happened to SecondFi Between June 21st and 23rd, SecondFi experienced a security incident that resulted in approximately 16.1 million ADA (~$2.6 million) being stolen from 374 wallets. We want to provide users with a transparent update based on the information currently available. An independent investigation EMURGO engaged Groom Lake, an independent forensic investigation / blockchain intelligence provider to assist with tracing and evidentiary analysis and they reviewed the incident using primary technical evidence, including code, code history, and public blockchain data. What the investigation indicates to date: 1. Attack from an external actor: linked to high-volume addresses employing advanced tradecraft: @0xGroomLake indicates that the primary operation behind the unauthorised transfers was sophisticated, external, and well-funded, with indicators consistent with activity by a professional, state-aligned threat actor. Certain indicators are being assessed for potential overlap with known DPRK-linked threat activity of Lazarus Group. 2. Two separate attackers: Groom Lake also identified activity by a second party that appears, based on current evidence, to be separate from the primary operation and to have affected a different set of wallets during the same window. No overlap in affected wallets has been identified to date. The root cause: A cryptographic flaw The root cause was a highly subtle flaw in how the wallet software generated per-transaction signatures. In simplified terms, a value that should have been derived from secret information could, under certain conditions, be computed from public transaction data. This could enable affected private key material to be derived from information visible on the public blockchain. This cryptographic flaw was also visible in a copy of the relevant code that had been published without authorisation to a public GitHub repository. We are continuing to assess the circumstances surrounding the publication and are cooperating with the relevant authorities. Fix and winding down of SecondFi The flaw has been patched, and new wallets created with the corrected software are not known to be affected by this issue. However, given the gravity of this event and as previously announced, we have made the difficult decision to wind down SecondFi and Yoroi wallet. Asset recovery and safe migration Our current priority is supporting affected users, assisting recovery efforts, and enabling users to move assets securely. 1. Recovery tool: A secure recovery tool using zero-knowledge (ZK) proofs is being developed. The portal is designed to allow users to initiate the process directly while limiting the information required to do so. The tool is currently in testing, and we are engaging a specialist third-party auditor to review it before its anticipated release in August 2026. 2. Safe migration: In the meantime, we are preparing wallet export functionality designed to allow users to migrate their assets to a wallet of their choice. We anticipate releasing this by early August 2026. Please follow our official channels for further updates. Important Security Reminder SecondFi will NEVER request private keys, recovery phrases, or wallet credentials, and we will never DM you first. Do not trust any checker, link, or account outside our official channels: ▪️ X accounts: @secondfiapp and @secondfi_jp ▪️ Support portal:

Quarantine Mode Is now live across Chrome extension, iOS, and Android. What you need to do: - If your SecondFi app is still in maintenance mode and not quarantine mode, you are on an older version. Please update your existing app to the latest version through your app store if it has not updated automatically. IMPORTANT: This is the same app. Do not download a new or separate app. What quarantine mode means: - It's the same application, with transactions disabled - You can view your balance and wallet address only - You cannot send, swap, or move funds Please protect yourself from scams. Only download SecondFi from our official link: Do not accept download links from anyone else, including emails, messages claiming to be from SecondFi.

How to check if your SecondFi / Yoroi Wallet was affected and submit a support ticket Step 1: With quarantine mode now live, you can view your balance and check whether your wallet address was affected in the recent incident. If your wallets are potentially impacted, a warning banner will appear on your Home screen in the SecondFi app. Tap it to view your wallet status. Please note that statuses are based on preliminary, non-final data from our review of the incident and remain subject to further review.

⚠️ SecondFi Is Currently in Quarantine Mode SecondFi is running in quarantine mode. It's the same application, but transactions are disabled. You can view your balance and wallet address only, you cannot send, swap, or move funds. A screenshot is below so you know what to expect. Please protect yourself from scams. Only download SecondFi from our official link: Do not accept download links from anyone else, including emails, messages claiming to be from SecondFi. Chrome extension is live, app store is pending store approval.

Security Alert: Fake SecondFi Extensions and Apps We've seen scammers create fake SecondFi browser extensions and apps. Please read this before you install anything or click any link claiming to be from us. There is no new application or link, it is the same. Do not accept links from anyone, including people claiming to be SecondFi team members, support, or partners. We will not DM or email you links to download software, sign a transaction, or take any action with your assets. If you receive a message like that, it's a scam. Do not click it. The only official SecondFi extension is "searchable" in the Chrome Web Store. If you see any other extension using the SecondFi name or branding, it's fake. Check for the verified blue checkmark. Our official extension listing carries a blue verified check, shown in the screenshots below. If the listing you're looking at doesn't have it, do not install it. Scammers can and do clone extensions and apps to steal funds. When in doubt, go directly to and verify links yourself rather than trusting anything sent to you. Please check carefully that you are using the correct application

Your Options for Securing Assets, and What’s Next We recognize that some users may not have completed all steps in the Hardware Wallet Guidance posted in our knowledge base. If you are not technically proficient, we recommend waiting for the secure wallet export functionality, which is currently intended to launch next week. Here is an update on upcoming options: • This week: Quarantine mode We will enable quarantine mode, which will let users check whether a wallet address appears in preliminary incident-related data and submit a support ticket with the relevant wallet address. • Next week: Secure wallet export functionality We intend to deploy secure wallet export as the next phase of quarantine mode. This is intended to provide a safer way for users of varying experience levels to move assets to a new wallet. • On potential asset recovery As stated previously, we intend to support a process relating to potential asset recovery for users whose wallets are confirmed through the applicable process. Any such process remains subject to further investigation, verification, eligibility criteria, applicable terms and conditions, and technical implementation. It is currently expected to involve a recovery tool using zero-knowledge proofs, initiated by users through a portal, designed to help users remain in control of the process while protecting their information. Again, if you are not technically proficient, we recommend waiting for these options to go live. For now, you may submit a ticket at We will continue sharing updates as progress is made.

Important Security Update. As stated, we have identified the root cause of the incident. It is at the address level. The affected software signer used a deterministic nonce derivation flaw. Every time an address signed a transaction, it leaked enough information to mathematically reconstruct that address's private key from public blockchain data alone. If you were affected by the attack, your first/default address (index 0) is almost certainly exposed. It is the address that some wallets may be using by default or as the only address at all, and nearly always has transactions. That history is all an attacker needs. Please DO NOT RESTORE your recovery phrase into another Cardano wallet. This does not mitigate the security risk. Your keys are derived from your recovery phrase, not from the app. Restoring the same phrase into another wallet recreates identical addresses with identical exposure. The compromised thing is the key of the compromised address(es), not the interface you are using. If you were affected by the attack, and use any of your compromised address(es) to deposit it could be drained again. This includes withdrawing staking rewards even using another wallet. Reward withdrawal and delegation are signed with the stake credential. The withdrawn funds could be routed to your first/default address (as indicated above), which has a high chance of being compromised (wallets work differently managing it). Mempool-monitoring adversaries can front-run or sweep your assets on confirmation. There has been conflicting advice from community members in an attempt to be helpful. Do nothing until official steps come from SecondFi. We are working to facilitate the verification process so users can claim back their assets safely. Following the above is very important, if not it makes verified claims more difficult. The only thing you should do right now is submit a ticket at We will never DM you first or ask for your recovery phrase.

🚨 An Important Security Update from the SecondFi Team We identified a security issue impacting a small number of Cardano wallets on our platform. We have contained the issue and paused the affected functions. Our engineering teams are actively working to restore full functionality to the platform. To protect our users, SecondFi has been temporarily placed into maintenance mode. All front-end interactions are paused.