Key Highlights
- SecondFi has rolled out a web-based recovery interface based on zero-knowledge proofs that will securely recover assets lost in the June exploit.
- Threat actors may lure victims to give up seed phrases through fake copycat sites using phishing ads on search engines, emails, and direct messaging.
- The recovery process is self-service and only works at the official domain, avoiding any contact with staff or direct fee requests.
SecondFi, the digital asset platform previously called Yoroi Wallet, has launched a browser-based utility to help users who lost their assets in the recent security incident. The vulnerability, exploited between June 21 and June 23, 2026, was used to compromise 374 self-custodial accounts and led to the unauthorized withdrawal of 16.1 million ADA tokens, worth roughly $2.6 million.
SecondFi Forensic Timeline and Underlying Software Vulnerability
The breach stemmed from a programming anomaly within the software’s digital signature generation library. External forensic investigators found that the system used deterministic values instead of random values to generate transaction nonces. This vulnerability allowed outsiders to analytically reconstruct private keys from the data available to the public on the Cardano blockchain.
Groom Lake analysis shows that the main operation was spearheaded by a sophisticated cyberattack, similar to those of threat groups such as Lazarus. However, no official attribution has been made, and a distinct secondary attacker struck simultaneously.
Emergency safeguards managed to isolate and preserve around 129 million ADA from further risk, but the regular application functions were turned into read-only by SecondFi later on. The new recovery process operates locally in client web browsers, applying customized zero-knowledge proofs to ensure secure authentication of the user and handling requests for asset distribution.
Phishing Tactics and Technical System Mandates
This mechanism could spur an immediate increase in secondary exploitation attempts releasing the capability. SecondFI cautions that malicious third parties would be pushing out junk emails, targeted search ads, and automated direct messages with phishing links that mimic the recovery interface.
According to the shared post, multiple affected users have unwittingly handed over their secret seed phrases to these websites, giving up their other security measures.
In order to avoid additional depletion of capital, the genuine recovery cycle is subject to certain procedural rules. All operations are kept on the main SecondFi Platform, and users have to enter the address manually, as it is crucial for the valid certificate mapping.
The verification software requires a significant amount of computer resources, including at least two gigabytes of RAM, at least 50 Mbps internet speed, and a central processor from the past five years.
Moreover, operators emphasize that administrative staff will never initiate direct contact, send links through social media, or collect a processing fee. However, security experts warn that zero-knowledge validation continues to be a “self-service” pipeline, meaning that users should never share the components of their credentials with anyone pretending to be a member of a support team.
Cardano Price Sees Fresh Bear Cycle Within Channel Pattern
SecondFI exploit showcased limited and mostly localized rather than systemic impact on Cardano. Since early July, the Cardano price has remained in a steady recovery trend within the formation of a rising channel pattern.
The daily chart highlights two rising trendlines offering dynamic support and resistance to ADA holders. Since last week, the ADA price has dropped from $0.27 to the current trading value of $0.24, accounting for a drop of roughly 7%.
This pullback signals a potential bear cycle within the channel pattern, suggesting that the ADA coin could drop another 13% and retest the lower trendline in the $0.217 region. If the bottom trendline holds, the Cardano price will continue on its bullish trajectory and attempt a recovery targeting $3.
Nonetheless, if the coin price breaks below the bottom trendline, the ADA price will enter a deeper correction below $0.2.
