SecondFi to Shut Down Following $2.6 Million ADA Theft
SecondFi is preparing to shut down its operations following a security breach that led to the theft of around 16.1 million ADA, valued at approximately $2.6 million. The breach exposed vulnerabilities in the wallet's security, leaving hundreds of users in limbo as they await recovery options. An independent investigation by Groom Lake, a blockchain intelligence firm, indicated that a sophisticated external actor was responsible for the attack, with potential links to North Korea's Lazarus Group, although no definitive attribution has been made. The breach impacted 374 wallets.
The announcement comes nearly a month after SecondFi first reported the exploit in late June. Users are still waiting for recovery tools and migration options that the company had initially promised to deliver within weeks. SecondFi is currently developing a recovery tool based on zero-knowledge proofs, which aims to assist affected users in recovering their assets while minimizing the amount of information they need to disclose. This tool is still undergoing testing and will be subject to review by a third-party auditor before its anticipated release in August.
In addition to the recovery tool, SecondFi is working on wallet export functionality to allow users to transfer their assets to other services. However, the company has not announced any direct reimbursement plans or indicated whether it would compensate users from its own funds. Frustration has mounted among users who feel left in the dark regarding their options for recovering or migrating their assets after the exploit. Earlier communications from SecondFi advised users against restoring recovery phrases into new Cardano wallets, cautioning that moving funds would not eliminate the risk while the investigation was ongoing.
On June 27, SecondFi had indicated that a recovery path had been identified and that the process would begin within two weeks, pending testing and security reviews. Nearly a month later, the company has acknowledged that the recovery tool is still under development, now expected to launch in August. Users have expressed their dissatisfaction, noting that they were initially told their funds could be recovered much sooner. Cointelegraph reached out to SecondFi for further details regarding potential reimbursement plans but did not receive a response by the time of publication. EMURGO also did not respond to earlier inquiries for comment.
