SecondFi: Previous Security Incident Suspected to Be Linked to North Korea's Lazarus Group, Asset Recovery Tool to Launch in August

Foresight News reports that Cardano wallet service provider SecondFi has released an update on its security incident investigation. The investigation was conducted by Groom Lake, an independent blockchain forensics firm commissioned by EMURGO. Findings indicate that the incident involved two independent attackers: the primary attacker employed advanced techniques, with some indicators overlapping with known activities of North Korea's Lazarus Group, which is currently under further evaluation; the second attacker operated independently of the primary attack, involving different wallet addresses. The root cause of the incident was identified as a cryptographic flaw in the wallet software during the generation of transaction signatures. The flaw theoretically allowed attackers to deduce private key materials of affected wallets from publicly available on-chain data. The defective code had previously been unauthorizedly published on a public GitHub repository. SecondFi stated that it is continuously assessing the situation and cooperating with regulatory authorities in the investigation. The vulnerability has since been fixed, and new wallets created using the patched version are not affected. SecondFi announced the closure of SecondFi and Yoroi wallets. Regarding asset recovery, SecondFi is developing a zero-knowledge proof-based asset recovery tool, expected to be released in August 2026. Prior to this, a wallet export feature will be introduced to enable users to migrate their assets to other wallets. Foresight News previously reported that SlowMist estimated losses from the SecondFi security incident to exceed $20 million. SecondFi later disclosed that the incident involved four instances of fund transfers, three of which were carried out by external attackers, resulting in approximately 16 million ADA being transferred from 374 addresses. SecondFi has since transferred approximately 129 million ADA to an independent third-party custodial institution for safekeeping.