SecondFi Recovery Clock: How a Cardano Wallet Bug Became a Seed-Phrase Safety Story

Picture this. You wake up, open your Cardano wallet, and the balance you checked last night is gone. Not a dust attack.

Not a misclick. Just empty. That was the reality for hundreds of SecondFi users over one long June weekend.

By midweek, a wallet-generation bug had morphed into something bigger: a seed-phrase safety story. People assumed importing their phrase into a different app would save them. It didn’t.

The exposure sat at the address level and came back the moment an affected address signed anything. SecondFi and EMURGO moved into triage mode. On-chain data started painting a clearer picture, and a recovery clock began to tick.

SecondFi disclosed a Cardano wallet-generation vulnerability after coordinated drains between June 21 and June 23, 2026. Initial tallies pointed to roughly 16 million ADA taken from 374 addresses across three main drains, according to early reporting by CoinDesk. That was the first pass.

Forensics widened the lens. Wallet bugs break trust fast. Seed handling decides whether a bad week becomes a bad year.

Bitquery’s reconstruction identified two waves and a large consolidation address, with a second-wave vault holding 129,430,001 ADA by June 23. Their work also logged roughly 3,072 victim wallets swept across both waves, far beyond the first estimate of impacted addresses. See the on-chain write-up from Bitquery.

Here’s the kicker from both Bitquery and SecondFi: the flaw was address-level. Importing an affected recovery phrase into a different Cardano wallet did not eliminate risk. The risk showed up when an affected address signed a transaction at any time, per the joint warning captured in Bitquery’s report and SecondFi’s updates (Bitquery / SecondFi).

What Actually Went Wrong in SecondFi’s Wallets SecondFi has referred to a wallet-generation vulnerability. That points to issues around how addresses or keys were derived, stored, or used during signing. We don’t need the exact line of code to understand the blast radius: if an addres