Exploit and Recovery Status
Published 6/29/2026, 6:05:33 PM
SecondFi has established a two-week recovery plan following a Cardano wallet exploit that occurred between June 21–23, 2026. While the company reports that the process is currently "on track" for asset returns to begin around July 12, 2026, the recovery system is still in the build and testing phase and has not yet been independently verified or audited [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
Exploit and Recovery Status
The exploit was caused by a deterministic nonce derivation flaw in SecondFi's proprietary wallet generation software, allowing attackers to reconstruct private keys using public on-chain data [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
| Metric | Details |
|---|---|
| Exploit Date | June 21–23, 2026 |
| Confirmed Losses | 16 million ADA (~$2.4M) |
| Affected Wallets | 374 addresses |
| Recovery Timeline | ~2 weeks (announced June 28, 2026) |
| Expected Start of Returns | July 11–12, 2026 |
| Current Phase | Build/Test (as of June 29, 2026) |
Recovery Mechanism
SecondFi's strategy relies on wallet state snapshots taken immediately after the incident to automate the reconciliation process.
- Technical Approach: Engineers are currently testing multiple recovery solutions in parallel to ensure security before deployment [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
- Wallet Checker: A tool for users to verify if their addresses were affected is scheduled for release in early July 2026 [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
- User Action: The protocol has explicitly stated that no user action is required for the recovery; users should not move funds manually or restore seed phrases, as the vulnerability exists at the address level [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
Risks and Uncertainties
While the two-week window is the official target, several factors could impact the actual recovery date:
- Testing Requirements: The solution must undergo rigorous security reviews before assets can be transferred [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
- Lack of Independent Audit: As of June 29, 2026, there has been no independent verification of the wallet state snapshots or the recovery system's efficacy [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
- Active Scams: Multiple fake accounts are impersonating SecondFi support. Users are warned that the official recovery process will never ask for private keys or seed phrases [Source: https://crypto.news/secondfi-cardano-exploit-recovery-plan/].
In summary, SecondFi aims to recover funds by July 12, 2026, but this timeline remains prospective until the recovery system successfully passes its current testing phase.