Tools Crypto Exploit Tracker exploit-0027
Exploit record
SecondFi
- Loss
- $2M
- Attack vector
- Private Key Compromise
- Chain
- Cardano
- Sector
- Wallet
What happened
Cardano wallet project SecondFi confirmed three attacks between 21 and 23 June 2026 that drained 16 million ADA (about $2.4 million) from 374 wallets, with SlowMist estimating up to $20 million potentially at risk.
The flaw was a deterministic nonce derivation bug in SecondFi's proprietary software signer: every signed transaction leaked cryptographic information that allowed attackers to reconstruct users' private keys from public blockchain data alone. The team rescued a further 129 million ADA to a third-party custodian before attackers could reach it and, with EMURGO, launched a two-week recovery and restitution plan with a checking tool for affected wallets.
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026