SecondFi Warns Cardano Users Not To Move Wallets After 16M ADA Exploit

SecondFi has told affected Cardano users not to restore recovery phrases into another wallet after a security incident drained about 16 million ADA from 374 addresses.

The wallet product, formerly known as Yoroi, identified the root cause at the address level. Restoring the same recovery phrase into another Cardano wallet does not reduce the exposure, because the security risk occurs when an affected user signs a transaction.

Affected users have been told to take no action until official steps are published. The only current instruction is to submit a ticket through support.secondfi.io.

SecondFi will never send direct messages first, ask for a recovery phrase or ask users to transfer funds. The warning follows conflicting advice from community members during the incident, with users told to wait for official recovery steps before signing anything.

16M ADA Lost, 129M ADA Secured

The incident involved four draining events, including three executed by external threat actors. The attacks resulted in the loss of roughly 16 million ADA across 374 addresses.

Emergency action secured about 129 million ADA during the active incident. Those funds are being moved to an independent qualified third-party custodian for the benefit of affected wallet addresses, while an external accounting firm verifies the holdings.

SecondFi has rolled out a patch for unaffected wallets and placed the app in maintenance mode. Front-end interactions, including transactions, remain paused while verification, recovery and restoration work continues.

The issue has been tied to SecondFi’s native Cardano web wallet generation software, not Cardano consensus. The exposure sits with affected wallet addresses and signing activity, while ADA itself and the Cardano network continue operating normally.

Earlier Cardano Drain Cluster Appears Connected

The SecondFi disclosure appears to overlap with the Cardano wallet-drain cluster tracked earlier this week.

That earlier onchain activity showed 196 sweep transactions, 178 unique source stake keys, 191 source payment addresses and more than 12 million ADA in source-side input. It also tracked about 1.685 million USDCx moving through a pass-through wallet after assets were swept and converted.

The earlier cluster did not have a confirmed wallet provider, signing flow, fake interface, dApp or seed-phrase exposure attached to it at the time. The latest SecondFi root-cause update points to an address-level issue triggered when affected users sign transactions.

The overlap is not confirmed by a final postmortem yet, but the timing, affected asset flows and wallet-level root cause now point to the same wider Cardano wallet incident rather than two unrelated ADA drain events.

Recovery Runs Through Official Support

SecondFi’s recovery process now depends on support tickets, wallet-specific verification, custodian handling and accounting review. Restoring an affected phrase into another Cardano wallet can make claims harder and does not remove the security risk.

Users have been told not to sign transactions, not to restore affected recovery phrases elsewhere and not to follow unofficial instructions from community members. Any direct message asking for a seed phrase or transfer should be treated as a scam.

SecondFi remains in maintenance mode after about 16 million ADA was stolen and about 129 million ADA was secured for affected users. Official support tickets are the only recovery route while the custodian process, accounting verification and final technical review continue.

The post SecondFi Warns Cardano Users Not To Move Wallets After 16M ADA Exploit appeared first on Crypto Adventure.