16.1 Million Cardano (ADA) Exploit: SecondFi Urges Hacker to Return Stolen Funds

The team behind the Cardano-focused cryptocurrency wallet SecondFi today published a renewed appeal to the hacker who breached the platform in June. The developers reiterated that their official bounty offer remains in effect in exchange for the full return of the stolen assets.

“Our standing offer remains open. We urge the party involved to contact us through the channels listed below,” SecondFi said in its official statement. The company added that a voluntary return is the cleanest and most direct path toward resolving the situation for all parties.

Interestingly, after the independent analytics agency Groom Lake joined the investigation, researchers discovered specific digital markers in the transactions and actions of one of the participants in the attack. These markers reportedly match methods used by the state-sponsored North Korean cybercrime group Lazarus Group.

How SecondFi plans to repay users

Since the likelihood of receiving a response from Lazarus Group is extremely low, SecondFi, together with the Cardano Foundation and Input Output Group, has launched a three-stage compensation plan:

• Late July — the current stage: Collection, verification and processing of official claims submitted by affected customers.
• Mid-August 2026: Release of tools for securely exporting surviving assets to third-party platforms. Users are advised to move their funds to hardware wallets.
• Early September 2026: Launch of an automated compensation portal powered by zero-knowledge proofs.

The critical security incident occurred between June 21 and June 23, 2026. The attackers managed to compromise 374 digital wallets on SecondFi, formerly known as Yoroi Wallet by EMURGO. The hackers stole 16.1 million Cardano tokens, or $ADA, worth approximately $2.4 million to $2.6 million at the time of the theft.

The scale of the disaster could have been significantly greater. The project’s technical team responded in time and secured another 129 million $ADA that had been at risk. These funds were urgently transferred to the control of an independent custodian.

Nevertheless, because of the severe financial and reputational consequences of the breach, EMURGO’s management made a difficult decision. The company announced the complete wind-down and subsequent liquidation of the SecondFi and Yoroi brands. The project has been deemed unviable for continued operations.