Massive Cardano Heist: SecondFi Reveals Plan to Return $16.1M Stolen Funds

SecondFi, the developers behind the Cardano wallet, have unveiled a detailed, step-by-step roadmap to address the aftermath of a significant hack that occurred in June 2026. Following the security breach, the project has announced it is permanently winding down its regular operations and will not resume normal service. All team resources are now exclusively dedicated to one critical mission: safely withdrawing the remaining assets and facilitating the distribution of compensation to affected users.

To achieve this, SecondFi's developers are pioneering a new technological approach. In collaboration with Input Output Group and the Cardano Foundation, they are launching the first-ever Web3 compensation tool powered by zero-knowledge proofs. This innovative solution is central to their three-stage recovery plan, designed to return funds to users impacted by the incident.

The hack, which took place in June 2026, resulted in the theft of 16.1 million ADA, valued at approximately $2.5 million at the time, from 374 SecondFi wallets. The attackers, identified as the Lazarus Group, exploited a vulnerability within the Android version of the SecondFi application, enabling them to cryptographically derive users' private keys. Fortunately, the project team managed to secure a substantial amount, saving 129 million ADA by transferring these funds to custodial storage.

The published roadmap outlines three distinct stages for recovery:

1. Claims Submission (Already Available): SecondFi has integrated a simplified ticket system directly into its application. Affected users are required to update their app to the latest version and submit a formal claim. This is the initial step for users to register their loss.

2. Migration Tool (Mid-August): This stage involves the release of a specialized utility designed to automatically withdraw users' assets. The tool will unstake ADA and facilitate the transfer of coins, tokens, and NFTs to any other Cardano wallet chosen by the user. Users are strongly cautioned against deleting their SecondFi wallet or uninstalling the application during this stage, as doing so could complicate or hinder the recovery process. The migration tool has already been developed and is currently undergoing an external security audit to ensure its reliability and security.

3. ZK Refund Portal (Early September): Representing the core technical innovation of the roadmap, this zero-knowledge-proof-based portal will enable affected users to securely prove ownership of their compromised wallets and claim their compensation without needing to disclose their seed phrases or private keys. This critical tool is scheduled to undergo thorough cryptographic audits and extensive testing throughout August, emphasizing the project's commitment to security and user privacy.

In light of the project's closure and ongoing recovery efforts, SecondFi has issued an urgent security reminder regarding the prevalence of phishing scams. Scammers are actively exploiting the situation by creating fake browser extensions and contacting users via private messages, falsely posing as customer support representatives. SecondFi emphasizes that they will NEVER request private keys, recovery phrases, or wallet credentials, and will NEVER initiate direct messages or emails. Users are advised not to click on any links from unsolicited contacts, even those claiming to be from the SecondFi team, support, or partners. The only legitimate extension is available through the Chrome Web Store and bears a blue verification badge. All links and information should be verified exclusively through SecondFi's official website to ensure safety and prevent further compromise.