TLDR
SecondFi, the successor to Yoroi Wallet on Cardano, suffered a major breach that has led EMURGO to shut down both the SecondFi and Yoroi brands.
- The breach between 21 and 23 June 2026 stole 16.1 million ADA from 374 wallets on SecondFi, with traces linked to North Koreas Lazarus Group.
- SecondFi, the Cardano Foundation and Input Output are coordinating a three-stage compensation and asset export plan for affected users.
- The shutdown highlights growing wallet security risk, especially around off-chain infrastructure and key management, rather than smart contract bugs alone.
Deep Dive
1. Breach And Brand Shutdown
According to a detailed incident report, the SecondFi platform, formerly Yoroi Wallet by EMURGO, was breached over 21-23 June 2026, resulting in the theft of 16.1 million ADA from 374 user wallets, worth roughly 2.4-2.6 million dollars at the time of the attack. Investigators later found digital markers consistent with prior operations by North Korea-linked Lazarus Group, although any direct response from the group is considered unlikely. In the aftermath, EMURGO judged the financial and reputational damage too severe and announced a full wind-down and liquidation of both the SecondFi and Yoroi brands, effectively ending the product line as a viable wallet service, as outlined in the breach and shutdown summary.
Yoroi is not just temporarily paused, it is being retired, so users should treat it as a sunset product rather than waiting for a relaunch.
2. User Impact And Compensation Plan
To mitigate losses, SecondFi, working with the Cardano Foundation and Input Output, has launched a structured three-stage plan. First, in late July 2026, they began collecting, verifying and processing official claims from affected customers. Second, in mid August 2026, they plan to release tools that let users securely export any surviving assets to third party platforms, with guidance favoring hardware wallets for long term storage. Third, in early September 2026, they expect to open an automated compensation portal using zero knowledge proofs to manage payouts. Separately, the technical team moved an additional 129 million ADA that was at risk into custody with an independent provider, protecting that portion from the attacker.
If you ever used Yoroi or SecondFi, the key steps are to file claims promptly if affected and to migrate remaining funds to wallets whose security model you trust.
3. Wallet Security Lessons For Crypto Users
This incident fits a broader pattern where most recent losses come from compromised keys, infrastructure and social engineering, not purely from on chain code flaws. In the Cardano ecosystem, the SecondFi case underlines that even wallets with reputable backers can be vulnerable if operational security, monitoring and off-chain components are not hardened against nation state level attackers. For crypto users more generally, it reinforces the value of minimizing hot wallet exposure, diversifying trusted providers and regularly reviewing how your wallets handle custody, export options and incident response.
Conclusion
The SecondFi breach has effectively ended the Yoroi wallet brand while opening a path for affected Cardano users to claim compensation and secure remaining funds. The episode illustrates that wallet and infrastructure security is now a central risk in crypto, and that users benefit from proactively choosing setups with strong operational security and clear contingency plans, especially for long term holdings.
CoinsKid.Com