SecondFi has announced the permanent shutdown of its Cardano wallet application. All remaining team resources will now support the recovery of stolen funds and the safe return of user assets following a security breach in June 2026.

Attackers took 16.1 million ADA, valued at approximately $2.5 million at the time, from 374 wallets. The incident stemmed from a vulnerability in the Android version of the application that allowed private keys to be derived. The project linked the intrusion to the Lazarus Group. Before further losses occurred, the developers transferred 129 million ADA into custodial storage.

Support From Cardano Ecosystem Partners

SecondFi is working with Input Output Group and the Cardano Foundation to build what the team describes as the first Web3 compensation tool based on zero-knowledge proofs. The system will let affected users prove ownership of compromised wallets without revealing seed phrases or private keys.

Rather than restoring ordinary wallet services, the project has published a three-stage roadmap aimed at orderly claims, asset migration, and eventual compensation.

Three-Stage Recovery Roadmap

The first stage is already live. An updated version of the SecondFi application contains a simplified claims portal. Users must install the latest release and submit recovery requests through the integrated system.

The second stage is scheduled for mid-August. An automated migration utility will unstake ADA and move coins, tokens, and NFTs to any other Cardano wallet chosen by the user. The tool has been completed and is undergoing an external security audit. Developers strongly advise against uninstalling the application or deleting the existing wallet before migration is finished, as doing so could hinder the process.

The third stage, expected in early September, centers on a zero-knowledge proof refund portal. Independent cryptographic audits and testing will take place throughout August. Once live, the portal will allow verified owners of the affected wallets to claim compensation without exposing sensitive key material.

Warnings Against Phishing Attempts

With the project winding down normal operations, fraudulent activity has already appeared. Scammers are creating fake browser extensions and sending private messages that impersonate support staff.

SecondFi stated that it never initiates contact with users through private messages. The only legitimate browser extension is the one listed on the Chrome Web Store that carries the official verification badge. Users are instructed to confirm every recovery-related link exclusively through the project’s official website before taking any action.

The team continues to prioritize the protection of remaining user assets and the orderly distribution of compensation through the staged process developed with ecosystem partners.