SecondFi published a three-stage roadmap to return 16.1 million ADA stolen from 374 wallets in a June exploit. The Cardano wallet provider is permanently winding down operations. A zero-knowledge proof-based refund portal is planned for early September.
SecondFi, a Cardano wallet provider, published a formal roadmap to return funds stolen in a June exploit that drained 16.1 million ADA from 374 user wallets, as the project permanently winds down operations.
"The team has committed all remaining resources to a single goal: safely returning assets to affected users," SecondFi developers said in the roadmap published July 27. The project will not resume normal service.
Hackers exploited a vulnerability in the Android version of the SecondFi app, allowing them to cryptographically derive users' private keys. The attack, attributed to the Lazarus Group, stole 16.1 million ADA — worth about $2.5 million at the time. The team managed to save 129 million ADA by transferring the funds to custodial storage before the exploit escalated.
The recovery plan unfolds in three stages. Claims submission is already available through an updated ticket system in the app. A migration tool, currently undergoing external security audit, will launch in mid-August to automatically unstake ADA and transfer coins, tokens and NFTs to any Cardano wallet selected by the user. In early September, SecondFi plans to release a zero-knowledge proof-based refund portal — the first Web3 compensation tool of its kind on Cardano — allowing affected users to prove ownership of compromised wallets without revealing seed phrases or private keys. The ZK tool will undergo cryptographic audits throughout August.
SecondFi warned users about phishing attacks already targeting the shutdown. Scammers are creating fake browser extensions and impersonating customer support through private messages. The team said it never contacts users first, and the only legitimate extension carries a blue verification badge on the Chrome Web Store. Users should not delete their SecondFi wallet or uninstall the application before the migration tool goes live, as doing so could complicate the recovery process.
The permanent closure of SecondFi and the 16.1 million ADA exploit adds to a growing list of high-profile wallet breaches on Cardano this year, raising questions about security standards across the ecosystem's application layer. With 129 million ADA still under custodial control, the success of the ZK refund portal will determine whether affected users recover their full balances — and whether the broader Cardano DeFi community can restore confidence after one of its largest wallet-level attacks.
This article is for informational purposes only and does not constitute investment advice.
